{"id":"DEBIAN-CVE-2026-114609","details":"fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML \u003cimg src\u003e values, SVG \u003cimage href\u003e or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.","modified":"2026-10-24T09:47:32.969062422Z","published":"2026-10-22T18:17:28.060Z","upstream":["CVE-2026-114609"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-114609"}],"affected":[{"package":{"name":"fpdf2","ecosystem":"Debian:13","purl":"pkg:deb/debian/fpdf2?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.3-1","2.8.3-1+deb13u1","2.8.4-1","2.8.4-2","2.8.7-1","2.8.7-2","2.8.8-1","2.8.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114609.json"}},{"package":{"name":"fpdf2","ecosystem":"Debian:14","purl":"pkg:deb/debian/fpdf2?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8-1"}]}],"versions":["2.8.3-1","2.8.4-1","2.8.4-2","2.8.7-1","2.8.7-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114609.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}