Local File Policy Bypass Vulnerability in pdfmake by bpampuch
CVE-2026-114491

6.9MEDIUM

Key Information:

Vendor

Bpampuch

Status
PDFmake
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114491?

The pdfmake library versions prior to 0.3.12 are susceptible to a local file policy bypass due to improper handling of setLocalAccessPolicy() with SVG images. Attackers can exploit this vulnerability by supplying a crafted document definition that includes an SVG image referencing a local file path. This can lead to unauthorized access to sensitive data embedded in the generated PDF documents, enabling attackers to read files that should be restricted.

Affected Version(s)

pdfmake 0.3.8 < 0.3.12

References

https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568...
patch
https://github.com/bpampuch/pdfmake/releases/tag/0.3.12
release-notes
https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Rende...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.