{"id":"CVE-2026-114609","summary":"fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content","details":"fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML \u003cimg src\u003e values, SVG \u003cimage href\u003e or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.","aliases":["GHSA-rw7v-4hrq-x6r9"],"modified":"2026-10-23T02:47:48.360293847Z","published":"2026-10-22T17:18:22.802Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114609.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114609.json"},{"type":"FIX","url":"https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432"},{"type":"FIX","url":"https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d"},{"type":"FIX","url":"https://github.com/py-pdf/fpdf2/pull/1824"},{"type":"FIX","url":"https://github.com/py-pdf/fpdf2/pull/1857"},{"type":"WEB","url":"https://github.com/py-pdf/fpdf2/releases/tag/2.8.8"},{"type":"ADVISORY","url":"https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114609"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/py-pdf/fpdf2","events":[{"introduced":"0"},{"fixed":"e1fc653d8fce65d2fb118755bda8581a9bf1e4d9"},{"fixed":"0d27190a8c907e02ebe9cd881471a14d0622b432"},{"fixed":"6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.8.8"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"0d27190a8c907e02ebe9cd881471a14d0622b432"}]},{"range":[{"fixed":"6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e1fc653d8fce65d2fb118755bda8581a9bf1e4d9"}],"source":"REFERENCES_TAG","original_tag":"2.8.8"}]}}],"versions":["2.8.7","2.8.6","2.8.5","2.8.4","2.8.3","2.8.2","2.8.1","2.7.9","2.7.8","2.7.7","2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.1","2.6.0","2.5.7","2.5.6","2.5.5","2.5.4","2.5.3","2.5.2","2.5.1","2.5.0","2.4.6","2.4.5","2.4.4","2.4.3","2.4.2","2.4.1","2.4.0","2.3.5","2.3.4","2.3.3","2.3.2","2.3.1","2.3.0","2.2.0","2.1.0","2.0.5","2.0.0","binary","1.7.1","1.7","unicode","gif","png_alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114609.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}