CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114609?
CVE-2026-114609 is a medium-severity vulnerability in py-pdf fpdf2, published on 22 Oct 2026.
Official description
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
Weakness: CWE-918
Which versions are affected by CVE-2026-114609?
2 open source packages ship an affected version, including fpdf2.
| Package | Affected | Fixed in |
|---|---|---|
fpdf2 PyPI | All versions | 2.8.8 |
fpdf2 PyPI | All versions | 2.8.8 |
Linux distribution packages (1)
python-fpdf2 openSUSE:Tumbleweed | All versions | 2.8.9-2.1 |
How do I fix CVE-2026-114609?
Upgrade fpdf2 to 2.8.8 or later.
Is CVE-2026-114609 being exploited?
There is no known exploitation of CVE-2026-114609 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114609, GHSA-rw7v-4hrq-x6r9, openSUSE-SU-2026:12278-1.