CVE-2026-63630
Received Received - Intake

Deserialization Flaw in BentoPDF Enables Timestamp Exfiltration

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-63630
EUVD
EUVD-2026-86242

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BentoPDF versions 2.8.6 and earlier have a vulnerability in deserializeWorkflow() that allows importing crafted workflow JSON files. The issue involves the Timestamp node's tsaUrl parameter, which is accepted without validation. When a user processes a PDF with this workflow, the application sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 hash to an attacker-controlled endpoint. The default configuration bypasses CORS proxy checks, enabling direct requests to untrusted hosts.

Detection Guidance

This vulnerability involves BentoPDF sending PDF SHA-256 hashes to attacker-controlled servers during timestamp requests. To detect it, monitor outbound network traffic for HTTP/HTTPS requests to unexpected Time Stamping Authority (TSA) endpoints during PDF processing. Check logs for RFC 3161 timestamp requests originating from BentoPDF instances. Look for unusual URLs in workflow import files that specify custom TSA endpoints.

Impact Analysis

An attacker could exploit this to learn that you processed a specific PDF file by capturing its SHA-256 hash. This allows tracking of document usage across users without exposing the file's contents. The impact is limited to privacy risks rather than data theft or system compromise due to the vulnerability's low severity.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing document processing metadata (SHA-256 hashes) without user consent. While the actual file contents remain secure, the ability to track document usage across users may conflict with data minimization and user privacy principles required by these regulations.

Mitigation Strategies

Upgrade BentoPDF to version 2.8.7 or later immediately. The vulnerability is fixed in this release. If upgrading is not immediately possible, review all imported workflow files for suspicious TSA URL configurations and block outbound connections to unauthorized TSA endpoints at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart