{"id":"ghsa-ghsa-rw7v-4hrq-x6r9","seq":1708827,"kind":"advisory","title":"fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content","url":"https://github.com/advisories/GHSA-rw7v-4hrq-x6r9","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rw7v-4hrq-x6r9","summary":"影響: pip:fpdf2 <= 2.8.7 → 2.8.8\nfpdf2 implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, fpdf2 may issue outbound HTTP(S) requests or attempt to open local filesystem paths. This behavior is relevant in applications that render untrusted or user-provided input without sanitizing or restricting embedded resource references. Description In affected versions, fpdf2 uses a shared internal image-loading mechanism…","severity":"medium","techs":["python"],"cves":["CVE-2026-114609"],"tags":["GHSA-rw7v-4hrq-x6r9","fpdf2"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T14:43:16.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}