CVE-2025-56590
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-02-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apryse | html2pdf | 11.10.0 |
| apryse | html2pdf | 11.5.0 |
| apryse | html2pdf | 11.7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-56590 is a critical vulnerability in the Apryse HTML2PDF SDK's InsertFromURL() function. The vulnerability occurs because the module passes URL inputs directly as command line arguments to Headless Chromium without proper sanitization. An attacker can supply a specially crafted URL containing malicious command line instructions, which are then executed on the server with the privileges of the application user. This allows arbitrary operating system command execution on the local server. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary operating system commands on the server running the Apryse HTML2PDF SDK. This means the attacker could potentially take control of the server, access sensitive data, modify or delete files, disrupt services, or use the server as a foothold to attack other systems within the network. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for suspicious or unexpected command executions triggered by the InsertFromURL() function in the Apryse HTML2PDF SDK. Since the vulnerability allows arbitrary OS commands via crafted URL inputs, you can look for unusual command line arguments passed to Headless Chromium or unexpected processes spawned by the application user. For example, on Linux systems, you might check process invocation logs or use commands like `ps aux | grep chromium` to inspect running Chromium processes for suspicious arguments. Additionally, monitoring application logs for InsertFromURL() calls with unusual URL parameters or scanning for execution of commands like `/bin/id` can help detect exploitation attempts. Network monitoring for unusual outbound requests or payloads containing command injection patterns may also be useful. However, no specific detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves strictly sanitizing all data passed to the PDF conversion functions, especially the InsertFromURL() function, to ensure that input cannot be interpreted as command line arguments by the HTML2PDF module. This includes using trusted HTML sanitizers and applying output encoding where appropriate to prevent injection of malicious commands. Since no official vendor patch or fix exists as of the public disclosure, rigorous input validation and sanitization are the primary defenses against exploitation. [1]