CVE-2026-57532CWE-80

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser

High · published June 25, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

Malicious HTML content contained in the layout specification of a PDF

ticket or badge layout was executed when the PDF editor is opened in the

browser. This could allow one backend user to inject JavaScript into

the browser context of another backend user. Due to requirements of the

PDF rendering and editing libraries used, this is one of the few pages

in our backend that do not have a strong Content-Security-Policy that

would render this capability useless for most scenarios.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-06-25T14:32Z
EPSS history
Timeline
  • 25 JUN 14:32Z
    Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
    cvelistv5