CVE-2018-19047: Mpdf Project Mpdf

Critical severity, CVSS 10.0. EPSS: 2.1% chance of exploitation in the next 30 days.

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble.

Affected products

• Mpdf Project Mpdf: up to and including 7.1.6

Published 2018-11-07. Last modified 2026-06-17.