CVE-2026-114491
pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
bpampuch pdfmake
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.3.12pdfmakeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Text from CVE List
Affected versions 1
- pdfmakeaffected: 0.3.8 before 0.3.12CVE List
References 4
- github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfddFixvia CVE List
- github.com/bpampuch/pdfmake/releases/tag/0.3.12Fixvia CVE List
- vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-imagesAdvisoryvia CVE List
- github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372Referencevia CVE List