CVE-2024-1647 — pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS

CVE-2024-1647

pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS PUBLISHED

Description (CNA)

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.

Affected (CNA)

Vendor / product	Versions
pyhtml2pdf / pyhtml2pdf	affected 0.0.6

CWE

CWE-79

References

https://pypi.org/project/pyhtml2pdf/
https://fluidattacks.com/advisories/oliver/

ADP enrichment

CVE

No English description supplied.

https://pypi.org/project/pyhtml2pdf/
https://fluidattacks.com/advisories/oliver/

CISA-ADP

No English description supplied.

No references supplied.