CVE-2025-56589 describes a critical Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) vulnerability within the Apryse HTML2PDF SDK, affecting versions up to 11.6.0. This flaw, residing in the InsertFromHtmlString() function, allows unauthenticated attackers to read arbitrary local files or initiate HTTP requests to internal/external services. With a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity, posing a significant risk of sensitive data disclosure or potential system compromise. Its FAUCET Risk Score of 96/100 further emphasizes its severity. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. However, the vulnerability has garnered notable community discussion, with 10 mentions, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 11.7.0CPE matchmatch criteria | cpe:2.3:a:apryse:html2pdf:*:*:*:*:*:*:*:* | ||
11.10.0CPE matchmatch criteria | cpe:2.3:a:apryse:html2pdf:11.10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.