CVE-2026-63630: BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITECORSPROXYURL, so the request bypasses the proxy's ALLOWEDTSAHOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BentoPDFto a version that resolves this vulnerability.Fixed in 2.8.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of BentoPDF 2.8.6 and earlier who import an attacker-crafted workflow and then run its Timestamp step against a PDF are exposed. The default self-hosted configuration is affected because it does not set VITE_CORS_PROXY_URL, causing the timestamp request to be sent directly.
What must an attacker do to obtain document-related information?
An attacker must convince a user to import a crafted JSON workflow containing a Timestamp node with an attacker-controlled tsaUrl, then have the user execute that workflow on a PDF. The attacker receives an RFC 3161 request containing the PDF's SHA-256 MessageImprint.
What information is disclosed?
The request discloses the PDF's SHA-256 digest, not the PDF contents. This can be used to confirm that a document matches a known file or to correlate the same document across users.
What should teams do if they cannot patch immediately?
Do not import untrusted workflows or run Timestamp steps from imported workflows against sensitive PDFs. Configuring VITE_CORS_PROXY_URL allows requests to go through the proxy, where ALLOWED_TSA_HOSTS checks are available.
How can teams remediate the vulnerability?
Upgrade BentoPDF to version 2.8.7, which fixes the issue.