CVE-2026-114491 — pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attack…
Published: 2026-10-21 · CVSS: 6.9 · CVSS 4.0
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7