CVE-2026-82866: @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@pdfme/commonto a version that resolves this vulnerability.Fixed in 5.5.10
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @pdfme/common before 5.5.10 are exposed when an attacker can control the basePdf template field. The impact applies where getB64BasePdf runs and can make network requests to attacker-selected URLs.
What does an attacker need to exploit it?
The attacker needs the ability to supply or modify the basePdf value in a template. No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity.
What should be done if upgrading is not immediately possible?
Prevent untrusted users from controlling the basePdf template field and restrict outbound network access from systems processing templates. This reduces the ability to target internal endpoints or metadata services.
How can I determine whether my deployment is affected?
Check whether your application uses @pdfme/common at a version earlier than 5.5.10 and whether basePdf can contain attacker-controlled URLs. Review template ingestion paths and outbound requests made while processing base PDFs.