Description

Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T15:17:24.060Z",
  "pubdate": "2026-08-06T15:17:24.060Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the e2pdf product affecting versions <= 1.32.40.\nThis security flaw allows remote, unauthenticated attackers to read arbitrary files from the underlying server's filesystem, potentially exposing sensitive configuration files, source code, and system data.\nThe vulnerability poses severe risk implications, as successful exploitation requires no prior authentication or administrative privileges, lowering the attack barrier significantly.\nThe root cause stems from improper input validation and sanitization within the vulnerable e2pdf component, failing to restrict file path resolution requests originating from external untrusted inputs.\nAttackers can leverage this capability by supplying crafted parameters that traverse the directory structure, forcing the application to include and render local files.\nMitigation requires applying official vendor updates beyond version 1.32.40 or implementing strict input filtering to restrict directory traversal sequences.",
  "technicalDetails": "The vulnerability resides within the e2pdf plugin <= 1.32.40, specifically impacting components responsible for handling file inclusion or template rendering without proper parameter sanitization.\nThe root cause is characterized by insufficient validation of user-supplied input passed to file loading or inclusion functions, allowing directory traversal patterns such as dot-dot-slash sequences to be processed.\nNetwork exposure is direct via HTTP/HTTPS protocols, as the vulnerable endpoints are accessible to unauthenticated remote users over the web interface.\nAuthentication and privilege requirements are entirely absent, meaning any unauthenticated network attacker can initiate exploitation attempts directly against the target system.\nThe attack flow proceeds as follows: First, the attacker identifies an exposed endpoint within e2pdf that processes file paths or template identifiers. Second, the attacker crafts an HTTP request containing directory traversal payloads or absolute file paths directed at sensitive system resources, such as /etc/passwd or application configuration files. Third, the vulnerable component fails to sanitize the input, passing the malicious path directly to the filesystem inclusion routine. Finally, the application processes the file and reflects its contents back in the HTTP response or logs, achieving arbitrary file read capability.\nThe payload behavior involves traversing out of the intended web root directory into restricted system directories to extract sensitive data.\nPost-exploitation impact includes the exposure of critical credentials, database connection strings, environment variables, and underlying operating system files, which can facilitate further system compromise and lateral movement."
}