CVE-2024-56521

What it actually does

TCPDF prior to 6.8.0 configures libcurl with CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER disabled or set to unsafe values, disabling TLS certificate validation for any HTTP requests made via the library.

Why it matters to the business

Organizations using TCPDF for PDF generation that involve network fetches face risk of intercepted or altered content being processed without detection, potentially leading to supply-chain compromise or data exfiltration in document workflows.

How an attack unfolds

An attacker positioned on the network path intercepts TCPDF-initiated HTTPS requests, presents a forged certificate, and supplies malicious payloads or redirects because certificate checks are bypassed by the unsafe curl options.

How to fix it

Upgrade tecnickcom/tcpdf to the commit aab43ab0a824e956276141a28a24c7c0be20f554 (version 6.8.0 or later) so that CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are configured safely when libcurl is used.

How to confirm the fix worked

Confirm the installed TCPDF version is 6.8.0 or newer; review source for proper curl option settings; test HTTPS fetches with intentionally invalid certificates to verify rejection.

Typical attack path

1. Identify applications using TCPDF to fetch remote resources over HTTPS
2. Position as network adversary capable of intercepting traffic to the target hostnames
3. Present a crafted certificate during the TLS handshake
4. Deliver altered or malicious content that TCPDF processes without validation
5. Achieve code execution, data theft, or further compromise via the processed content

How to detect it

Review application and web-server logs for unexpected external connections initiated by the PHP process hosting TCPDF; inspect network traffic for TLS sessions with invalid or self-signed certificates accepted by the application; search process execution logs for curl or PHP requests to untrusted domains.

What your security team should do

• Immediately upgrade all instances of tecnickcom/tcpdf to the fixed commit
• Audit code paths that trigger remote fetches through TCPDF
• Enforce network-level TLS inspection or proxy rules that reject invalid certificates
• Monitor dependency scanners for any remaining older TCPDF versions