CVE-2026-114491
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Oct 21, 2026
CISA due date
—
The record
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-73
- CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. CWE-73
- CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and… CWE-73
- CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer files and… CWE-73
- CVE-2026-61738 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-73
- CVE-2026-5461 The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all… CWE-73
- CVE-2026-118561 External Control of File Name or Path vulnerability in Drupal Single Content Sync allows… CWE-73
- CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-73