CVE-2026-114491 in pdfmake
Summary
by MITRE • 10/21/2026
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in pdfmake versions prior to 0.3.12 represents a significant security flaw related to access control enforcement within dynamically generated documents. Specifically, the library fails to correctly apply restrictions defined by the setLocalAccessPolicy method when processing images that are embedded via SVG content references. This oversight creates an inconsistency between how standard image resources and those referenced through Scalable Vector Graphics (SVG) elements are handled during the PDF generation process. The core technical flaw lies in the parsing logic for SVG tags, which bypasses the local file access checks implemented to prevent unauthorized reading of files from the server's filesystem or client environment where applicable.
In a typical secure configuration, developers utilize setLocalAccessPolicy to restrict pdfmake from loading resources such as images, fonts, or stylesheets from arbitrary local paths on the system running the PDF generation service. This is a critical security measure designed to prevent Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) attacks that could lead to sensitive data exposure. However, when an attacker supplies a document definition containing an SVG element with an href attribute pointing to a local file path, the rendering engine processes this reference without invoking the same validation checks applied to direct image tags. Consequently, the restricted content is successfully read and embedded into the final PDF output, effectively circumventing the intended security boundary.
The operational impact of this vulnerability allows attackers who have control over the document definition input to exfiltrate sensitive information from the host system. By crafting an SVG element with a href attribute pointing to critical configuration files, source code, or other restricted resources, an attacker can retrieve their contents and embed them into the generated PDF file. This capability transforms what might seem like a minor rendering inconsistency into a severe data leakage vector. In environments where pdfmake is used on servers to generate reports for users, this flaw enables remote attackers to read arbitrary files from the server's filesystem, potentially leading to further compromise of the underlying infrastructure through credential theft or reconnaissance.
This vulnerability aligns with CWE-200, which covers Information Exposure, as it results in the unintended disclosure of sensitive system information. Furthermore, it relates to CWE-918, specifically Server-Side Request Forgery (SSRF), because the application acts on behalf of an attacker to fetch resources from internal or local locations that should be inaccessible. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with techniques used in Data Exfiltration over Alternative Protocol, where data is moved out of the network via seemingly benign file formats like PDFs. It also reflects weaknesses in input validation and access control enforcement found in CWE-284 Improper Access Control.
To mitigate this risk, organizations must immediately upgrade pdfmake to version 0.3.12 or later, as these versions include patches that ensure the local access policy is consistently applied across all resource types, including those referenced within SVG structures. For environments where upgrading is not immediately feasible, a temporary mitigation involves implementing strict input validation on any document definitions received from untrusted sources. This includes sanitizing SVG content to remove or restrict href attributes that point to file system paths rather than valid URLs. Additionally, deploying web application firewalls with rules capable of detecting and blocking requests containing suspicious local path patterns in PDF generation parameters can provide an additional layer of defense against exploitation attempts until the software is updated.