CVE-2026-57535

LowCVSS 2.1/10Last modified Jun 25, 2026

Description

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

Metrics

CVSS 4.0 2.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status CVE-2026-575377.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.CVE-2026-57546.1Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scri CVE-2026-575457.8Memory corruption when processing draw objects of incorrect type during graphics command list execution.CVE-2026-575467.5Transient DOS when processing a continuous receive command with a zero-sized global configuration override.CVE-2026-57556.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IF CVE-2026-575547.8Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.CVE-2026-575557.8Memory Corruption when executing system service routines due to improper handling of user input buffers.CVE-2026-575597.8Memory corruption while processing service requests.CVE-2026-57567.5Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's CVE-2026-575685.7Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to sto CVE-2026-575692.3Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resol