PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the… (CVE-2026-108554)
Description
PDFMathTranslate (pdf2zh) versions up to 1.9.11 have a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The vulnerability arises because the translate_file handler forwards user-supplied URLs to a download function without validating the scheme or address. This can enable attackers to access internal services and cloud metadata endpoints and retrieve PDFs returned by those services.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/pdfmathtranslate/PDFMathTranslateRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108554 describes an SSRF vulnerability in PDFMathTranslate (pdf2zh) through version 1.9.11. The translate_file handler accepts user input URLs and passes them to the download_with_limit function without validating the URL scheme or address. This lack of validation permits unauthenticated attackers to coerce the server into fetching arbitrary URLs, including internal network services and cloud metadata endpoints, potentially exposing sensitive information embedded in the returned PDF documents.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This can lead to unauthorized access to internal services and cloud metadata endpoints, potentially exposing sensitive information. The CVSS score of 5.3 (medium severity) reflects the limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict or validate user-supplied URLs in the Link input to prevent access to internal or sensitive endpoints. Implement network-level controls to block unauthorized outbound requests from the server to internal or cloud metadata IP ranges.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-685q-m24h-8x9g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108554"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6acaad812cdf04f6565142ab
Added to database: 10/10/2026, 21:26:25 UTC
Last enriched: 10/10/2026, 21:29:14 UTC
Last updated: 10/10/2026, 22:48:25 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.