CVE-2024-32489

What it actually does

The library fails to sanitize or properly validate HTML input before PDF rendering, allowing injection of arbitrary HTML tags and attributes that are processed during document generation.

Why it matters to the business

Organizations using the library to create PDFs from user-supplied content risk generation of documents containing unexpected or malicious elements, potentially leading to data leakage, phishing via PDFs, or downstream processing failures.

How an attack unfolds

An attacker supplies crafted HTML containing malicious tags to any application endpoint that invokes the vulnerable PDF generation function; the library renders the input without proper escaping, embedding the attacker-controlled content into the resulting PDF file.

How to fix it

Upgrade tecnickcom/tcpdf to commit 51cd1b39de5643836e62661d162c472d63167df7 or later release 6.7.4; review and replace any custom HTML sanitization logic with the fixed library version.

How to confirm the fix worked

After upgrade, retest PDF generation with known malicious HTML payloads to confirm injection is blocked; scan dependency manifests for the exact commit hash or version string below 6.7.4.

Typical attack path

1. Identify an application endpoint that accepts HTML and passes it to TCPDF for PDF conversion.
2. Craft HTML payload containing injection primitives such as script, iframe, or style tags.
3. Submit the payload via the normal application workflow.
4. Retrieve or observe the generated PDF to confirm injected content is present and functional.

How to detect it

Review application logs for unusual HTML fragments or unexpected tags in PDF generation requests; inspect generated PDF files for embedded scripts or external resource references that were not part of the original template.

What your security team should do

• Immediately inventory all applications using tecnickcom/tcpdf and prioritize upgrade to the fixed commit.
• Implement input validation and output escaping for any HTML passed to PDF generators as a defense-in-depth measure.
• Monitor dependency update channels for future TCPDF releases and automate vulnerability scanning of open-source components.