CVE-2026-26801 Details
Description
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in pdfmake versions 0.3.0-beta.2 through 0.3.5. This vulnerability allows remote attackers to access sensitive information by exploiting the src/URLResolver.js component. The issue arises because the URLResolver does not properly enforce access policies for external URLs, potentially leading to unauthorized data retrieval.
Users can upgrade to pdfmake version 0.3.6 or later, which includes the `setUrlAccessPolicy()` method for defining custom access rules for external URLs. After updating, server operators should configure an appropriate URL access policy to mitigate the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bpampuch/pdfmake | [email protected] | Product |
| https://github.com/bpampuch/pdfmake/blob/master/src/URLResolver.js | [email protected] | Product |
| https://github.com/bpampuch/pdfmake/pull/2920 | [email protected] | Issue TrackingPatch |
| https://github.com/bpampuch/pdfmake/releases/tag/0.3.6 | [email protected] | Release Notes |
| https://mariopepe.github.io/cve-2026-26801-pdfmake-ssrf | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pdfmake pdfmake | >= 0.3.1, <= 0.3.5 0.3.0 - 0.3.0 beta10 0.3.0 beta11 0.3.0 beta12 0.3.0 beta13 0.3.0 beta14 0.3.0 beta15 0.3.0 beta16 0.3.0 beta17 0.3.0 beta18 0.3.0 beta19 0.3.0 beta2 0.3.0 beta3 0.3.0 beta4 0.3.0 beta5 0.3.0 beta6 0.3.0 beta7 0.3.0 beta8 0.3.0 beta9 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| Mar 17, 2026 | CVE Modified | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |