CVE-2018-19047

CRITICAL

mPDF < 7.1.6 - Server-Side Request Forgery via HTML Image Tag

Title source: llm

Description

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/mpdf/mpdf/issues/867

Scores

CVSS v3 10.0

EPSS 0.0208

EPSS Percentile 79.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

mpdf_project/mpdf < 7.1.6

Published Nov 07, 2018

Tracked Since Feb 18, 2026