CVE-2026-57535CWE-80

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags

Low · published June 25, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src

attribute of these images pointed to an URL, the PDF rendering engine

would download the image from that place and display it, thereby leaking

information about the rendering server and possibly creating an SSRF

vector in the local network.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
EPSS
0.00396 · 32.6th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-06-25T14:29Z
EPSS history
Timeline
  • 25 JUN 14:29Z
    Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags
    cvelistv5