The @pdfme/common library prior to version 5.5.10 contains a server-side request forgery (SSRF) flaw in its getB64BasePdf function. The function fetches arbitrary URLs without validation when the basePdf template is supplied by an attacker. An attacker who can control this template can cause the server or client to send HTTP requests to internal resources, which can lead to metadata exfiltration, network reconnaissance or blind request forgery against internal services. The weakness is classified as CWE‑918.

Vendors: pdfme:common. All installations using @pdfme/common versions earlier than 5.5.10 are impacted. The update 5.5.10 or later mitigates the flaw.

The vulnerability carries a CVSS score of 8.9, indicating high severity. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog. Attackers can exploit the flaw by embedding malicious URLs in the basePdf field, leading to unauthorized internal requests. Due to the lack of input validation, the attack surface is broad, making exploitation relatively straightforward for anyone who can influence the template content.