CVE-2019-1000005 - CVE House
Back to Database
Status published High CVE-2019-1000005

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of...

Vulnerability Description

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1000005

Credits & Attribution

No credits recorded in the NVD database.

References

More from mpdf project

View All →
CVE-2018-19047
mPDF through 7.1.6, if deployed as a web application that...
Critical 10

Affected Vendor

mpdf project

View all reports →

Affected Software

mpdf
Vulnerable Versions:
0

Timeline

Official Publish: February 4th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.