Is CVE-2026-114609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114609 being exploited in the wild.

How severe is CVE-2026-114609?

Medium severity, with a CVSS score of 5.8, published 22 October 2026.

Which products and versions are affected?

Py-Pdf Fpdf2 before 2.8.8; fpdf2 (PyPI) <= 2.8.7, ECOSYSTEM:introduced=0,fixed=2.8.8.

How is CVE-2026-114609 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114609?

Check whether you run Py-Pdf Fpdf2 or fpdf2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114609: fpdf2 SSRF and local file disclosure in image loader

Q: Is there a fix for CVE-2026-114609?

Yes. fpdf2 (PyPI): upgrade to 2.8.8 or later. Until then: Implement a configurable resource access policy to restrict which URLs and local paths the image loader may access. This allows administrators to whitelist safe locations and block internal or sensitive filesystem paths. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114609 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-114609?

Check whether you run Py-Pdf Fpdf2 or fpdf2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114609 · Severity: medium · CVSS 5.8 · Published 2026-10-22

fpdf2 is a Python library that creates PDF documents. Before version 2.8.8, it automatically fetches images from URLs or local paths that users supply in PDF content, without validating whether those locations are intended. An attacker can craft a PDF that makes the library request internal services or read local files, potentially exposing sensitive data or causing unwanted network activity.

Vendors: Py-Pdf, PyPI.

Quick answers

Is CVE-2026-114609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114609 being exploited in the wild.
How severe is CVE-2026-114609?: Medium severity, with a CVSS score of 5.8, published 22 October 2026.
Which products and versions are affected?: Py-Pdf Fpdf2 before 2.8.8; fpdf2 (PyPI) <= 2.8.7, ECOSYSTEM:introduced=0,fixed=2.8.8.
Is there a fix for CVE-2026-114609?: Yes. fpdf2 (PyPI): upgrade to 2.8.8 or later. Until then: Implement a configurable resource access policy to restrict which URLs and local paths the image loader may access. This allows administrators to whitelist safe locations and block internal or sensitive filesystem paths. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114609 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114609?: Check whether you run Py-Pdf Fpdf2 or fpdf2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fpdf2 (PyPI): upgrade to 2.8.8 or later
```
pip install "fpdf2>=2.8.8"
```

Implement a configurable resource access policy to restrict which URLs and local paths the image loader may access. This allows administrators to whitelist safe locations and block internal or sensitive filesystem paths.

Technical details

The image loader in fpdf2 automatically dereferences attacker-controlled HTTP(S) URLs and local filesystem paths supplied via FPDF.image(), FPDF.write_html() img src attributes, SVG image href/xlink:href attributes, and template image fields. This enables server-side request forgery (SSRF) to internal or external services and local file open attempts. Local content exposure is limited to valid image or SVG resources, and file:// URLs require raw filesystem paths rather than special protocol handling.

Affected products

py-pdf fpdf2 before 2.8.8

Identifiers

CVE-2026-114609
GHSA-rw7v-4hrq-x6r9

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.