Vulnerability vector:

• Base vulnerability score (CVSSv4.0): CVSS:4.0/ AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
• Severity (CVSSv4.0): 7.7 (high)

Description:

During the analysis of the HTML2PDF library version 5.3.1, despite the existence of the defense mechanism that was implemented to validate source image paths, a vulnerability allowing SSRF execution was found.

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 25.04.2025

Recommendations:

• Update to version 5.3.2 or higher

Researcher: Nikita Sveshnikov (Positive Technologies)