Vulnerability vector:
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity (CVSSv4.0): 6.9 (Medium)
Description:
The vulnerability was identified in mPDF, version 2.8.5.
The application performs improper validation of data received from the user, which allows an attacker to read files stored on the server.
Vulnerability status: Confirmed during research
Date of vulnerability discovery: 11.04.2025
Recommendations:
Mitigation measures for exploiting the vulnerability
1. HTML sanitisation
Remove scripts and frames: Use well‑maintained sanitisation libraries (e.g., Bleach for Python, HTML Purifier for PHP, or DOMPurify for JavaScript).
Whitelist tags: Allow only basic “safe” tags (e.g., `<b>`, `<i>`, `<p>`).
Clean URLs: Strip attributes that could point to local files or internal resources.
2. Prepared template
When generating a PDF, start from a pre‑built template. Pay special attention to any data supplied by the user – it must undergo strict sanitisation before being injected into the template.
3. Library configuration
- Disable access to local files;
- Disable JavaScript execution;
- Disable external resources – if possible, forbid loading of external images and CSS.
4. Minimize user privileges. Run processes under an account that has only read‑only access to an empty directory. This prevents reading system files via Path Traversal attacks.
5. Run the generator in an isolated container. Afterwards, restrict the container’s access to the internal corporate network and to the Internet.
6. Use firewall / network‑security mechanisms to limit the possibility of remote access to devices.
7. Move PDF creation to the user’s browser using libraries such as jsPDF.
Researcher: Nikita Sveshnikov (Positive Technologies)