CVE-2025-56590 is an OS command injection vulnerability in the InsertFromURL() function of the Apryse HTML2PDF SDK versions up to 11.10. An attacker can exploit this flaw remotely without authentication to execute arbitrary commands on the affected server, potentially leading to full system compromise. The vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available to confirm remediation status.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the local server running the vulnerable Apryse HTML2PDF SDK. This can lead to full system compromise, including data theft, system disruption, or further network penetration. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable functionality and consider applying network-level controls to limit exposure. Monitor for any vendor updates or security advisories regarding this vulnerability.