Medium severity · published Aug 31, 2026
CVE-2026-82866
@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
common · pdfme
before 5.5.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82866
vendor-advisory
https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff
third-party-advisory
https://www.vulncheck.com/advisories/pdfme-common-before-5.5.10-ssrf-via-unvalidated-url-fetch
More from common
6.8
CVE-2026-115729
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass