VULNERABILITY INTELLIGENCE

CVE-2025-56590

CVSS score9.8 CRITICAL
EPSS probability0.54%
CISA KEVNot currently listed
Published2026-01-22
Last modified2026-07-05
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server.

Weakness classification

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references