@pdfme/common: Server-Side Request Forgery via basePdf URL bypass
Summary
The @pdfme/common library fetches remote base PDF files through the getB64BasePdf function. Its URL denylist (isUrlSafeToFetch) can be bypassed using IPv4-mapped IPv6, [::], NAT64 or localhost-alias hostnames, so an attacker who controls a template's basePdf URL can make the library request loopback, internal or cloud metadata endpoints. The fetched response is embedded in the generated document, which may disclose internal data. The fetch only occurs where the window object is defined, i.e. in browsers or server-side DOM shims.
Affected
- @pdfme/common from 5.5.10 before 6.2.6 (CVE record)
- Vendor release notes list the range as 5.5.10 to 6.2.5
- Versions before 5.5.10 are affected by the related issue GHSA-pgx6-7jcq-2qff (CVE-2026-82866)
Fixed in
- @pdfme/common 6.2.6 (fix commit d03d0bc)
Workaround
Unknown.
- Until patched, do not accept basePdf URLs from untrusted users or templates.
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept available), automatable: no, technical impact: partial.
- Active exploitation: Unknown.
Our recommendation
- Update @pdfme/common to 6.2.6 or later, including all dependent applications.
- Check whether templates or applications allow user-supplied basePdf URLs and restrict them to trusted hosts.
- Block outbound requests from the PDF generation service to internal networks and cloud metadata addresses.
- Monitor logs for requests to loopback, private or metadata IP addresses from the PDF service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck advisory) www.vulncheck.com
- Fix commit d03d0bc github.com
- GHSA-2rg9-wxfw-wrr7 (vendor advisory) github.com
- GHSA-pgx6-7jcq-2qff (vendor advisory) github.com
- pdfme release 6.2.6 github.com
- NVD mirror on Vulners vulners.com
- HOL Guard CVE summary hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:27.
Original description (NVD)
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
NVD references (5)
- https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6
- https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7
- https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff
- https://www.vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypass
- https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.