CVE-2025-56589

HIGH

Apryse HTML2PDF < 11.7.0 - Local File Inclusion and Server-Side Request Forgery via InsertFromHtmlString

Title source: llm

Description

A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Both vulnerabilities could lead to the disclosure of sensitive data or potential system takeover.

References (2)

Core 2

Core References

Product

http://apryse.com

Exploit, Third Party Advisory

https://www.stratascale.com/resource/apryse-server-module-ssrf-lfi/

Scores

CVSS v3 7.5

EPSS 0.0043

EPSS Percentile 34.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (2)

apryse/html2pdf 11.10.0

apryse/html2pdf < 11.7.0

Published Jan 22, 2026

Tracked Since Feb 18, 2026