Executive brief
The Apryse HTML2PDF SDK, a tool used by developers to convert HTML content into PDF documents, contains a security flaw that allows for unauthorized data access. An attacker can exploit this to read sensitive files from the server's local storage or force the server to make unauthorized requests to internal or external web services. This could lead to the exposure of private system information or provide a foothold for further attacks on the internal network.
Technical details
A Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) vulnerability exists in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK. The SDK utilizes a headless Chromium instance to process HTML; however, it fails to sanitize user-provided HTML tags such as <iframe>. An attacker can provide a crafted HTML string containing tags with 'src' attributes pointing to local system files (e.g., file:///etc/passwd) or internal network resources. The headless browser will then render these resources into the resulting PDF, which is returned to the attacker. As of the latest advisory, the vendor has declined to patch the issue, and it remains present in versions up to 11.10.0. Mitigation requires manual sanitization of all HTML input before passing it to the SDK.
Affected products
- Apryse HTML2PDF SDK thru 11.10.0
Timeline
- 2025-07-18: disclosed: Initial report sent to vendor.
- 2025-08-04: other: Vendor acknowledges initial report.
- 2025-09-18: other: CVE assigned by MITRE.
- 2026-01-22: advisory: Public disclosure by Stratascale and NVD.