An unauthenticated local file inclusion vulnerability exists in e2pdf versions up to 1.32.40. This vulnerability (CVE-2026-66710) allows remote attackers to include local files on the server without requiring authentication, which can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The CVSS 3.1 base score is 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to include local files on the server, potentially leading to disclosure of sensitive information, modification of data, and disruption of service. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.