CVE-2026-82866: Server-Side Request Forgery (SSRF) in pdfme common

@pdfme/common versions prior to 5.5.10 contain an SSRF vulnerability in the getB64BasePdf function. When an attacker controls the basePdf template field, they can cause the server or client to fetch arbitrary URLs without validation. This can be exploited to perform blind request forgery attacks, enabling internal network reconnaissance and metadata exfiltration. The vulnerability is identified as CVE-2026-82866 with a CVSS 4.0 score of 8.9, indicating high severity.

Successful exploitation allows an unauthenticated attacker to induce the server or client to make arbitrary HTTP requests to internal or external systems. This can lead to unauthorized access to internal network resources, exfiltration of sensitive metadata, and reconnaissance of internal services. The vulnerability does not require privileges or user interaction but has a high attack complexity.

A fixed version 5.5.10 or later should be applied to remediate this vulnerability. Users should upgrade @pdfme/common to version 5.5.10 or higher. Since no vendor advisory or patch link is provided, verify the availability of the fix from the official project repository or vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.