Denial of Service Vulnerability in FPDI by Setasign
CVE-2025-54869

6MEDIUM

Key Information:

Vendor

Setasign

Status
Fpdi
Vendor
CVE Published:
6 August 2025

What is CVE-2025-54869?

The FPDI library, used for reading pages from existing PDF documents, has a Denial of Service vulnerability in versions 2.6.2 and earlier. Attackers can exploit this vulnerability by uploading specially crafted malicious PDF files that cause memory exhaustion, potentially crashing server-side scripts. This can lead to extended service unavailability, making it critical for users of FPDI to update to version 2.6.3 or later to mitigate the risk.

Affected Version(s)

FPDI < 2.6.3

References

https://github.com/Setasign/FPDI/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/Setasign/FPDI/commit/ba671ba9221cffd32...
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

.