---
id: 5486
title: "Portable Data exFiltration: XSS for PDFs"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/portable-data-exfiltration"
published_at: "2024-05-28T13:42:00Z"
tags: ["xss", "ssrf", "pdf", "data-exfiltration", "pdfium", "acrobat"]
phying_url: "https://phying.com/item/5486"
lang: en
---

# Portable Data exFiltration: XSS for PDFs

## Summary

Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-05-28T13:42:00Z
- **Original:** https://portswigger.net/research/portable-data-exfiltration
- **Phying News:** https://phying.com/item/5486