CVE-2026-82866: Pdfme Common

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

Affected products

• Pdfme Common: before 5.5.10 (fixed in 5.5.10)

Published 2026-08-31. Last modified 2026-10-08.