CVE catalog

CVE-2022-35583

wkhtmltopdf: CVE-2022-35583

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
16.36% · Oct 25, 2026

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwkhtmltopdfbookworm0.12.6-2vulnerable
Ubuntuwkhtmltopdfpro0.12.3.2-3vulnerable
Ubuntuwkhtmltopdfpro0.12.4-1vulnerable
Ubuntuwkhtmltopdfpro0.12.4-1ubuntu0.1~esm1vulnerable
Ubuntuwkhtmltopdf20.040.12.5-1vulnerable
Ubuntuwkhtmltopdf20.040.12.5-1build1vulnerable
Ubuntuwkhtmltopdf20.040.12.5-1ubuntu0.1vulnerable
Ubuntuwkhtmltopdf22.040.12.6-1vulnerable
Ubuntuwkhtmltopdf22.040.12.6-2vulnerable
Ubuntuwkhtmltopdf24.040.12.6-2vulnerable
Ubuntuwkhtmltopdf24.040.12.6-2build1vulnerable
Ubuntuwkhtmltopdf24.040.12.6-2build2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwkhtmltopdfsourcebookworm(unfixed)unimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [wkhtmltopdf]Affected

    Source package: [wkhtmltopdf]

    Details (2)

    • 0.12.6-2+b1 · amd64 · bookworm

      Affected

      dsa · wkhtmltopdf · debian · bookworm

    • 0.12.6-2+b1 · arm64 · bookworm

      Affected

      dsa · wkhtmltopdf · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]