CVE-2026-114609Published
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
Exact source revision recorded 29 Oct 2026 03:48:01 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-114609 · Microsoft / collected KEV context
cve-program · CVE-2026-114609
- https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9
- https://github.com/py-pdf/fpdf2/pull/1824
- https://github.com/py-pdf/fpdf2/pull/1857
- https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432
- https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d
- https://github.com/py-pdf/fpdf2/releases/tag/2.8.8
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.