Executive brief
PdfDing, a self-hosted PDF management and viewing platform, contains a security flaw in how it handles shared documents. The system fails to properly enforce expiration dates, view limits, or deletion status for users who were previously granted access to a file. This means an authorized recipient could continue to view or download sensitive documents even after the owner has revoked access or the link has officially expired.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in PdfDing's 'check_shared_access_allowed()' function. While the function validates that a user session exists, it fails to verify the 'SharedPdf.inactive' (which tracks expiration and max views) or 'SharedPdf.deleted' flags. Consequently, the 'Serve' and 'Download' endpoints, which rely on this function, remain accessible to any user with a valid session key previously associated with the share. An attacker with low privileges (a previously authorized session) can bypass intended temporal or usage-based restrictions to access PDF content. This issue is resolved in version 1.7.1 by adding explicit checks for the inactive and deleted states.
Affected products
- mrmn2 PdfDing < 1.7.1
Timeline
- 2026-03-30: patched: Version 1.7.1 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34586 published to NVD