Executive brief
Apryse HTML2PDF is a software development kit used by applications to convert web content and HTML into PDF documents. A critical security flaw allows an attacker to execute unauthorized commands on the underlying server by providing a specially crafted URL to the conversion tool. This could lead to a full system takeover, data theft, or service disruption, and as of the latest report, the manufacturer has not released a formal patch.
Technical details
An argument injection vulnerability exists in the InsertFromURL() function of the Apryse HTML2PDF SDK through version 11.10. The SDK utilizes Headless Chromium to process HTML conversion and passes user-supplied URLs directly as command-line arguments without sufficient sanitization. By supplying a crafted URL containing Chromium flags such as '--renderer-cmd-prefix', an attacker can achieve remote code execution (RCE) with the privileges of the application user. The vendor has reportedly declined to patch the issue; therefore, developers must manually sanitize all inputs passed to PDF conversion functions to ensure they cannot be interpreted as command-line arguments.
Affected products
- Apryse HTML2PDF SDK thru 11.10
Timeline
- 2025-07-18: disclosed: Initial report sent to vendor security team.
- 2025-09-18: other: CVE assigned by MITRE.
- 2026-01-21: advisory: Public disclosure by Stratascale.
- 2026-01-22: other: NVD published date.