7.5

CVE-2026-26801

Exploit
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pdfmake ≫ Pdfmake Version >= 0.3.1 <= 0.3.5
Pdfmake ≫ Pdfmake Version 0.3.0 Update -
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta10
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta11
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta12
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta13
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta14
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta15
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta16
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta17
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta18
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta19
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta2
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta3
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta4
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta5
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta6
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta7
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta8
Pdfmake ≫ Pdfmake Version 0.3.0 Update beta9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.376
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://github.com/bpampuch/pdfmake
Product
https://github.com/bpampuch/pdfmake/blob/master/src/URLResolver.js
Product
https://github.com/bpampuch/pdfmake/releases/tag/0.3.6
Release Notes
https://github.com/bpampuch/pdfmake/pull/2920
Patch
Issue Tracking
https://mariopepe.github.io/cve-2026-26801-pdfmake-ssrf
Third Party Advisory
Exploit