High · 8.8 CVE-2025-65875 EUVD-2025-206725GHSA-rwmj-c32v-585v

An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via u…

Published Feb 3, 2026 · Updated Feb 4, 2026 · Assigned by mitre

Description

An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.

References

http://www.fpdf.org
https://github.com/Setasign/FPDF
https://advisories.gitlab.com/pkg/composer/tecnickcom/tc-lib-pdf-font/CVE-2024-56520/