CVE-2026-19752

Received Received - Intake

Server-Side Request Forgery in mcp-dominican-layer PDF Parsing

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulDB

Description

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-19752

EUVD

EUVD-2026-58517

Affected Vendors & Products

Vendor	Product	Version / Range
enzovezzaro	mcp-dominican-layer	to 39dd373786712650097ad31db27d5c477c8f9c82 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the mcp-dominican-layer component up to a specific commit. It occurs in the PDF parsing function where an attacker can manipulate the pdfUrl argument to force the server to make unauthorized requests. The issue has been publicly disclosed and the project has not yet responded.

Detection Guidance

Detecting this vulnerability requires checking for server-side request forgery (SSRF) attempts targeting the parse-pdf function in mcp-dominican-layer. Monitor network logs for unusual outbound requests from the application, especially those involving PDF parsing. Check if the application accepts manipulated pdfUrl parameters that could trigger external requests.

Impact Analysis

An attacker could exploit this to make the server send requests to internal or external systems, potentially accessing sensitive data or services. This could lead to data breaches, unauthorized actions, or further network compromise depending on the server's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed due to the SSRF attack.

Mitigation Strategies

Immediately update mcp-dominican-layer to the latest version if available. If no patch exists, disable the parse-pdf function or restrict access to it. Implement input validation for pdfUrl parameters to prevent SSRF attacks. Monitor network traffic for suspicious outbound requests and block unauthorized external connections.

Hi! I’m here to help you understand CVE-2026-19752. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70