CVE-2026-82866CWE-918ssrf

CVE-2026-82866

Medium · published August 31, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.9 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-31T13:17Z
References (3)
https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff · [email protected]https://www.vulncheck.com/advisories/pdfme-common-before-5.5.10-ssrf-via-unvalidated-url-fetch · [email protected]https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:46Z
    @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
    cvelistv5