PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Blind trust: what is hidden behind the process of creating your PDF file?

swarm.ptsecurity.com | research | #appsec | #vulnerability-research | #web-security | #deserialization | #ssrf | #pdf | #dompdf | #mpdf | #tcpdf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM analyzed seven HTML-to-PDF libraries including TCPDF, mPDF, dompdf and jsPDF, finding 13 vulnerabilities plus risky defaults enabling SSRF, data leaks and DoS, with threat model and PoCs.
Published
Collected

Related coverage

research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
research · portswigger.net
Fickle PDFs: exploiting browser rendering discrepancies
Fickle PDFs abuse widget annotations to render differently per browser — the same invoice shows £399 in Safari but £999 in Chrome — enabling fraud. Code to build hybrid PDFs with PDFBox included.
research · portswigger.net
Portable Data exFiltration: XSS for PDFs
Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.
Back