7.5

CVE-2026-26801

Exploit
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pdfmake ≫ Pdfmake Version >= 0.3.1 <= 0.3.5
Pdfmake ≫ Pdfmake Version0.3.0 Update-
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta10
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta11
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta12
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta13
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta14
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta15
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta16
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta17
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta18
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta19
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta2
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta3
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta4
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta5
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta6
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta7
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta8
Pdfmake ≫ Pdfmake Version0.3.0 Updatebeta9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.376
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://github.com/bpampuch/pdfmake
Product
https://github.com/bpampuch/pdfmake/blob/master/src/URLResolver.js
Product
https://github.com/bpampuch/pdfmake/releases/tag/0.3.6
Release Notes
https://github.com/bpampuch/pdfmake/pull/2920
Patch
Issue Tracking
https://mariopepe.github.io/cve-2026-26801-pdfmake-ssrf
Third Party Advisory
Exploit