fpdf2 versions prior to 2.8.8 implicitly load external HTTP(S) URLs and local filesystem image paths when rendering content via its image and HTML/SVG rendering APIs. This can lead to outbound network requests or local file access attempts if untrusted input controls image references. The vulnerability may enable Server-Side Request Forgery (SSRF) and limited local file access depending on the content. A fix is available in version 2.8.8.