Server-Side Request Forgery in pdfmake by bpampuch
CVE-2026-26801
7.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-26801?
A Server-Side Request Forgery (SSRF) vulnerability exists in pdfmake versions 0.3.0-beta.2 through 0.3.5. This flaw enables a remote attacker to exploit the src/URLResolver.js component, potentially allowing access to sensitive information from the server. To mitigate this risk, version 0.3.6 introduces the setUrlAccessPolicy() method, which empowers server operators to establish specific rules for URL access. Additionally, a warning is logged when pdfmake operates server-side without an outlined access policy, enhancing security awareness.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.