AIKIDO-2026-320655
fpdf2 is vulnerable to Server-Side Request Forgery (SSRF)
58
Medium Risk
This Affects:
fpdf2TL;DR
fpdf2 uses a shared internal image loader that dereferences resource references embedded in rendered content. When an application renders untrusted HTML, SVG, template data, or image path strings, the loader fetches http and https URLs over the network and opens local filesystem paths without restriction. This lets untrusted input trigger requests to internal or external network services and limited local file open attempts. The fix adds a configurable resource access policy so applications can restrict or block implicit network and local resource loading.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted HTML, SVG, template data, or image path strings into FPDF.image(), write_html(), or template rendering.
Background info
fpdf2 is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 2.8.7.
How to fix this
Upgrade the fpdf2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant