CVE-2022-50897

MEDIUM

mPDF 7.0 - Local File Inclusion via Annotation File Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-50897. PoCs published by Musyoka Ian.

AI-analyzed exploit summary This exploit generates a payload for a Local File Inclusion (LFI) vulnerability in mPDF 7.0. It encodes the payload in URL and Base64 formats to facilitate inclusion of arbitrary files via an annotation tag.

Description

mPDF 7.0 contains a local file inclusion vulnerability that allows attackers to read arbitrary system files by manipulating annotation file parameters. Attackers can generate URL-encoded or base64 payloads to include local files through crafted annotation content with file path specifications.

Exploits (1)

exploitdb WORKING POC
by Musyoka Ian · pythonwebappsphp
https://www.exploit-db.com/exploits/50995

This exploit generates a payload for a Local File Inclusion (LFI) vulnerability in mPDF 7.0. It encodes the payload in URL and Base64 formats to facilitate inclusion of arbitrary files via an annotation tag.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: mPDF 7.0.x
No auth needed
Prerequisites: Access to the target application · Ability to inject the crafted payload into the application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Product product
https://mpdf.github.io/
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/mpdf-local-file-inclusion

Scores

CVSS v3 5.5
EPSS 0.0047
EPSS Percentile 37.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-98
Status published
Products (1)
mpdf_project/mpdf 7.0.0
Published Jan 13, 2026
Tracked Since Feb 18, 2026