CVE-2026-82866 — @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is att…
Published: 2026-08-31 · CVSS: 8.9 · CVSS 4.0
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7