CVE-2026-108554: PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of PDFMathTranslate (pdf2zh) through 1.9.11 that expose the Gradio Web GUI and allow access to its Link input are exposed. An unauthenticated remote attacker can use that input to cause the server to fetch URLs.
What can an attacker access through the vulnerable endpoint?
The attacker can direct the server to fetch arbitrary URLs, including internal services and cloud metadata endpoints. Returned PDF content can be retrieved through the application.
Is authentication or user interaction required?
No. The vulnerability is reachable by an unauthenticated attacker and does not require user interaction.
What mitigations are indicated if an update cannot be applied immediately?
The vulnerable request path lacks scheme and address validation. Restricting access to the Gradio Web GUI Link input would prevent unauthenticated users from submitting attacker-controlled URLs.