CVE-2026-108554 Details
Description
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.
A server-side request forgery (SSRF) vulnerability has been identified in PDFMathTranslate (pdf2zh) versions through 1.9.11. This vulnerability allows unauthenticated attackers to manipulate the server into fetching arbitrary URLs via the Link input. The issue arises because the translate_file handler forwards user-supplied URLs to the download_with_limit function without proper validation of the URL's scheme or address. As a result, attackers can access internal services, cloud metadata endpoints, and retrieve PDFs from these sources.
Users can update to PDFMathTranslate version 1.9.12 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/PDFMathTranslate/PDFMathTranslate | [email protected] | Vendor |
| https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L149-L179 | [email protected] | Source CodeVendor |
| https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L257-L269 | [email protected] | Source CodeVendor |
| https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/pdfmathtranslate-through-1.9.11-ssrf-via-gradio-web-gui-link-input | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PDFMathTranslate | <= 1.9.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |