Nine 0-days in HTML-to-PDF libraries: ReportLab RCE, ReLaXed RCE, WeasyPrint SSRF/LFR, mPDF, Dompdf and TCPDF flaws
Researcher Pedro Cruz (Hakai Security / The Hacking Club) disclosed nine vulnerabilities in widely used server-side PDF generation libraries, with a combined footprint of over 90 million monthly installs. The cases range from RCE (ReportLab, ReLaXed) through arbitrary file read and SSRF (WeasyPrint, Browsershot) to DoS and file/directory …