CVE-2021-29475

CVE-2021-29475 is a critical vulnerability affecting HedgeDoc (formerly CodiMD) that allows an attacker to read arbitrary files from the server's filesystem when exporting a note to PDF. This exploit requires the attacker to have the ability to modify a note, and it impacts all instances with PDF export enabled. The vulnerability has a CVSS score of 10.0 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, allowing access to sensitive data like configuration files and credentials. While there is no evidence of active exploitation, public exploit code, or significant community discussion, a fix is available in HedgeDoc version 1.5.0, and mitigation steps exist for those unable to upgrade immediately.