CVE catalog
CVE-2026-114609
python313-fpdf2-2.8.9-2.1 on GA media
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.25% · Oct 25, 2026
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | fpdf2 | 13 | 2.8.3-1 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.3-1+deb13u1 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.4-1 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.4-2 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.7-1 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.7-2 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.8-1 | vulnerable |
| Debian | fpdf2 | 13 | 2.8.9-1 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.3-1 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.4-1 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.4-2 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.7-1 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.7-2 | vulnerable |
| Debian | fpdf2 | 14 | 2.8.8-1 | fixed |
| Opensuse | python-fpdf2 | tumbleweed | 2.8.9-2.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | fpdf2 | deb | 14 | 2.8.8-1 | Not reported | DEBIAN-CVE-2026-114609 | Not reported |
| Opensuse | python-fpdf2 | rpm | tumbleweed | 2.8.9-2.1 | Not reported | OPENSUSE-SU-2026:12278-1 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [python3-fpdf]Affected
Source package: [fpdf2]
Details (2)
2.8.3-1+deb13u1· all · trixieAffected
pypi · fpdf2 · debian · 13
2.8.3-1+deb13u1· all · trixieAffected
pypi · fpdf2 · debian · 13
[openSUSE Tumbleweed]
- [python313-fpdf2]Unknown
Source package: [python-fpdf2]
Details (1)
2.8.7-1.2· noarch · tumbleweedUnknown · Fixed:
2.8.9-2.1Version impact unknown
pypi · python-fpdf2 · opensuse · tumbleweed
- [python314-fpdf2]Unknown
Source package: [python-fpdf2]
Details (1)
2.8.7-1.2· noarch · tumbleweedUnknown · Fixed:
2.8.9-2.1Version impact unknown
pypi · python-fpdf2 · opensuse · tumbleweed
Observed: