fpdf2

PyPI2 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting fpdf2page 1 of 1

CVE-2026-114609MEDIUMCVSS 5.8EG 5.8fixed in 2.8.8
2026-10-22
vulnerable: 2.0.0 ... 2.8.7 (52 versions)
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values,…
CVE-2026-114610MEDIUMCVSS 6.5EG 6.5fixed in 2.8.8
2026-10-22
vulnerable: 2.5.0 ... 2.8.7 (27 versions)
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced…

Check whether fpdf2 is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for fpdf2 CVEs against the assets you own.

Book a Demo →