Security Issue in TCPDF's SVG Font Handling

CVE-2024-56519

What is CVE-2024-56519?

A security flaw has been identified in earlier versions of TCPDF, specifically affecting the functionality of the setSVGStyles method. This vulnerability arises from the failure to adequately sanitize the SVG font-family attribute, which could potentially lead to various security risks. Developers using versions prior to 6.8.0 must be aware of this issue and consider upgrading to the latest release to ensure proper protection against possible exploits. For further details, refer to the official GitHub repository and documentation for TCPDF.

References