FKIE_CVE-2025-56589

Vulnerability from fkie_nvd - Published: 2026-01-22 17:15 - Updated: 2026-02-02 20:09
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Both vulnerabilities could lead to the disclosure of sensitive data or potential system takeover.
References
cve@mitre.orghttp://apryse.comProduct
cve@mitre.orghttps://www.stratascale.com/resource/apryse-server-module-ssrf-lfi/Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.stratascale.com/resource/apryse-server-module-ssrf-lfi/Exploit, Third Party Advisory
Impacted products
Vendor Product Version
apryse html2pdf *
apryse html2pdf 11.10.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apryse:html2pdf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "29DBED2C-0D66-48F8-B539-D3A0B39E95D4",
              "versionEndIncluding": "11.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apryse:html2pdf:11.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5AD5BCA-FF3F-4C6B-91DF-00CA12E4C82E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Both vulnerabilities could lead to the disclosure of sensitive data or potential system takeover."
    },
    {
      "lang": "es",
      "value": "Una inclusi\u00f3n local de ficheros (LFI) y una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) fue encontrada en la funci\u00f3n InsertFromHtmlString() del SDK Apryse HTML2PDF hasta la versi\u00f3n 11.6.0. Estas vulnerabilidades podr\u00edan permitir a un atacante leer ficheros locales en el servidor o realizar peticiones HTTP arbitrarias a servicios internos o externos. Ambas vulnerabilidades podr\u00edan llevar a la divulgaci\u00f3n de datos sensibles o a una potencial toma de control del sistema."
    }
  ],
  "id": "CVE-2025-56589",
  "lastModified": "2026-02-02T20:09:27.567",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-22T17:15:58.183",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "http://apryse.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.stratascale.com/resource/apryse-server-module-ssrf-lfi/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.stratascale.com/resource/apryse-server-module-ssrf-lfi/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.