Vulnerability Details CVE-2025-55853
SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF). The PDF converter function does not check if internal or external resources are requested in the uploaded files and allows for protocols such as http:// and file:///. This allows an attacker to upload an XML or HTML file in the application, which when rendered to a PDF allows for internal port scanning and Local File Inclusion (LFI).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 29.6%
CVSS Severity
CVSS v3 Score 9.1
Products affected by CVE-2025-55853
-
cpe:2.3:a:softvision:webpdf:10.0
-
cpe:2.3:a:softvision:webpdf:10.0.1
-
cpe:2.3:a:softvision:webpdf:5.0
-
cpe:2.3:a:softvision:webpdf:6.0
-
cpe:2.3:a:softvision:webpdf:7.0
-
cpe:2.3:a:softvision:webpdf:8.0
-
cpe:2.3:a:softvision:webpdf:8.0.0.2058
-
cpe:2.3:a:softvision:webpdf:8.0.0.2159
-
cpe:2.3:a:softvision:webpdf:8.0.0.2176
-
cpe:2.3:a:softvision:webpdf:8.0.0.2193
-
cpe:2.3:a:softvision:webpdf:8.0.0.2229
-
cpe:2.3:a:softvision:webpdf:8.0.0.2255
-
cpe:2.3:a:softvision:webpdf:8.0.0.2282
-
cpe:2.3:a:softvision:webpdf:8.0.0.2338
-
cpe:2.3:a:softvision:webpdf:8.0.0.2372
-
cpe:2.3:a:softvision:webpdf:8.0.0.2374
-
cpe:2.3:a:softvision:webpdf:8.0.0.2376
-
cpe:2.3:a:softvision:webpdf:8.0.0.2393
-
cpe:2.3:a:softvision:webpdf:8.0.0.2531
-
cpe:2.3:a:softvision:webpdf:8.0.0.2727
-
cpe:2.3:a:softvision:webpdf:8.0.0.2849
-
cpe:2.3:a:softvision:webpdf:8.0.0.2900
-
cpe:2.3:a:softvision:webpdf:8.0.0.3062
-
cpe:2.3:a:softvision:webpdf:8.0.0.3150
-
cpe:2.3:a:softvision:webpdf:8.0.0.3266
-
cpe:2.3:a:softvision:webpdf:8.0.0.3362
-
cpe:2.3:a:softvision:webpdf:8.0.0.3475
-
cpe:2.3:a:softvision:webpdf:8.0.0.3583
-
cpe:2.3:a:softvision:webpdf:8.0.0.3658
-
cpe:2.3:a:softvision:webpdf:9.0
-
cpe:2.3:a:softvision:webpdf:9.0.0.2732
-
cpe:2.3:a:softvision:webpdf:9.0.0.2843
-
cpe:2.3:a:softvision:webpdf:9.0.0.2898
-
cpe:2.3:a:softvision:webpdf:9.0.0.3081
-
cpe:2.3:a:softvision:webpdf:9.0.0.3149
-
cpe:2.3:a:softvision:webpdf:9.0.0.3264
-
cpe:2.3:a:softvision:webpdf:9.0.0.3361
-
cpe:2.3:a:softvision:webpdf:9.0.0.3479
-
cpe:2.3:a:softvision:webpdf:9.0.0.3584
-
cpe:2.3:a:softvision:webpdf:9.0.0.3655
-
cpe:2.3:a:softvision:webpdf:9.0.1
-
cpe:2.3:a:softvision:webpdf:9.0.2
-
cpe:2.3:a:softvision:webpdf:9.0.3
-
cpe:2.3:a:softvision:webpdf:9.0.4
-
cpe:2.3:a:softvision:webpdf:9.0.5