Image Loader Vulnerability in Python PDF Library by fpdf2

CVE-2026-114609

What is CVE-2026-114609?

The fpdf2 library, a widely-used PDF creation tool for Python, exhibits a significant vulnerability stemming from its shared image loader. Prior to version 2.8.8, this component was capable of automatically dereferencing attacker-controlled HTTP(S) URLs as well as raw local paths introduced through the FPDF.image() method, HTML attributes, and SVG image references. This weakness allows for outbound requests to potentially malicious internal or external services, and may also lead to unauthorized attempts to open local files. However, access to local content is limited to valid image or SVG resources. Importantly, file:// URLs were not handled specially, necessitating raw filesystem paths for local access. This issue has been addressed in the release of version 2.8.8.

References