CVE-2026-26801
Estado: AnalizadaAlta (7.5)—
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.61%
- Percentil entre todas las CVEs puntuadas: 48
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1090Proxycommand and control90 % - Impacto secundario
T1005Data from Local Systemcollection85 %
SSRF en aplicación web expuesta (AV:N, PR:N, UI:N) permite acceso a recursos internos vía URLResolver. CWE-918 confirma SSRF/proxy. La confidencialidad alta (C:H) indica exfiltración de datos sensibles.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-918
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-26801",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-26801",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-03-10T18:51:52.149011Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2026-03-10T19:17:17.430",
"references": [
{
"url": "https://github.com/bpampuch/pdfmake",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/bpampuch/pdfmake/blob/master/src/URLResolver.js",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/bpampuch/pdfmake/pull/2920",
"tags": [
"Issue Tracking",
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/bpampuch/pdfmake/releases/tag/0.3.6",
"tags": [
"Release Notes"
],
"source": "cve@mitre.org"
},
{
"url": "https://mariopepe.github.io/cve-2026-26801-pdfmake-ssrf",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en las versiones de pdfmake 0.3.0-beta.2 hasta 0.3.5 permite a un atacante remoto obtener información sensible a través del componente src/URLResolver.js. La corrección fue lanzada en la versión 0.3.6, que introduce el método setUrlAccessPolicy() permitiendo a los operadores del servidor definir reglas de acceso a URL. Ahora se registra una advertencia cuando pdfmake se utiliza del lado del servidor sin una política configurada."
}
],
"lastModified": "2026-06-17T10:26:20.543",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E25A90CB-0990-4A86-A2A0-DED5B772A4F3",
"versionEndIncluding": "0.3.5",
"versionStartIncluding": "0.3.1"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3D78BE8-BDF1-4F3D-A58B-6F72D92323E4"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E9F434F-B222-4B9E-894F-EF27349FD85A"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "302CBC0D-4021-43C9-9214-258EFAEBADA0"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "813FC92B-1352-46B2-98E5-177F2774A2FF"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6998E01F-28D0-4110-9B73-051917FC1786"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AE1D6C1-6D1F-40E2-A56B-D8975F41CF58"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A208BAFD-8F2C-4A30-87BC-9B9A4051113F"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D03BA7A-C32D-4FBA-8A45-3BB1EDFAA456"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A23B1591-3E81-4340-9136-CC650FA68234"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2DDEA62-21A3-408C-ABA5-E129F50F68CD"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BAA4EC5-4994-4B5F-AE0A-0C1ABEF00861"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "438BF14C-6B93-4D8C-BF7E-C7BA40E04595"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99C6EF3B-B002-4EB4-96DB-DFFFFED5570F"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60BC0F53-38A5-4BFD-95AC-47B7635BA52E"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F25A975-45B3-4D96-A3DA-EF388D7C0C78"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50BDBDEA-E9AA-4D3D-B0C1-35552D2A6FE0"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C08D75E-8340-4522-88C5-3871B461EA63"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC47E00A-8A0D-4D66-BA63-9D9400584815"
},
{
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76F34238-5ADD-4491-A01F-ECD62ECF10DB"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}