This CVE has been withdrawn by MITRE

MITRE marked CVE-2026-25630 as REJECTED on February 5, 2026. It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.

Reason given by MITRE

Reason: This candidate was issued in error.

CVE-2026-25630

✕ Withdrawn — historical dataCRITICALCVSS · not yet scored

—

survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.

Impact

Since SurveyJS PDF Generator depends on jsPDF, any project using survey-pdf v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability.

Solution

SurveyJS PDF Generator has upgraded jsPDF to version >= 4.0.0 and included the fix in the following survey-pdf releases:

* v1.12.59 * v2.5.5

Action

Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately.

Notes

No other survey-pdf dependencies are affected. This update is fully backward-compatible with previous survey-pdf releases.

CVSS v3: —
EchelonGraph score: Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB: —
EPSS %ILE: —
KEV: —Not applicable: this CVE ID was withdrawn

Published

February 4, 2026

Last Modified

February 4, 2026

Frequently asked(3)

What is CVE-2026-25630?

CVE-2026-25630 is a rejected CVE ID: its record was withdrawn on February 5, 2026 and no longer describes a vulnerability. Reason given: Reason: This candidate was issued in error.

When was the CVE record for CVE-2026-25630 published?

The CVE record for CVE-2026-25630 was published on February 4, 2026. EchelonGraph's copy of the record carries a last-modified date of February 4, 2026; the record at its source may have been updated since.

How do I remediate CVE-2026-25630?

There is nothing to remediate under CVE-2026-25630: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.