CVE-2026-108554
Received Received - Intake

Server-Side Request Forgery in PDFMathTranslate

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-108554
EUVD
EUVD-2026-96348

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PDFMathTranslate PDFMathTranslate 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PDFMathTranslate (pdf2zh) through 1.9.11 has a server-side request forgery (SSRF) vulnerability. Unauthenticated attackers can make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without validating the scheme or address, allowing attackers to access internal services and cloud metadata endpoints and retrieve returned PDFs.

Detection Guidance

To detect this SSRF vulnerability in PDFMathTranslate, monitor network traffic for outbound requests from the application to internal or unexpected external addresses. Check logs for URLs fetched via the Link input in the Gradio Web GUI. Use tools like curl to test if the application follows redirects to internal endpoints (e.g., 169.254.169.254). Inspect the translate_file handler for improper URL validation in pdf2zh/gui.py and pdf2zh/high_level.py.

Impact Analysis

This vulnerability allows attackers to access internal services, cloud metadata endpoints, and retrieve PDFs from the server. It could lead to unauthorized data exposure, internal document leaks, or further attacks if combined with other flaws. The impact ranges from blind SSRF to reading internal documents if the target returns a valid PDF.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of internal documents or metadata may result in non-compliance, potential data breaches, and regulatory penalties due to insufficient access controls.

Mitigation Strategies

Immediately update PDFMathTranslate to the latest version beyond 1.9.11. Implement strict URL validation in the translate_file handler to block non-HTTP/HTTPS schemes and private/internal IP ranges. Disable the Gradio Web GUI if unused. Restrict outbound network access for the application to prevent SSRF attacks. Monitor for unusual PDF retrieval requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart