CVE-2025-65875: Fpdf

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.

Affected products

• Fpdf Fpdf: version 1.8.6 only

Published 2026-02-03. Last modified 2026-06-17.