Client-Side PDF Toolkit Vulnerability in BentoPDF
CVE-2026-63630
What is CVE-2026-63630?
BentoPDF, a self-hostable client-side PDF toolkit, has a vulnerability in the deserializeWorkflow() function that improperly handles the Timestamp node's tsaUrl. In versions 2.8.6 and earlier, this flaw allows crafted workflows to invoke the timestampPdf() function, leading to an unauthorized request to an attacker-specified endpoint. This request sends a TimeStampReq containing the SHA-256 MessageImprint of the PDF, potentially allowing the attacker to validate the document's identity without viewing its contents. Furthermore, when deployed with the default configuration which lacks proper CORS proxy settings, these malicious requests can be executed without restrictions, correlating documents across various users. The issue has been resolved in version 2.8.7.
Affected Version(s)
bentopdf < 2.8.7