CVE-2022-50897

mPDF 7.0 contains a local file inclusion vulnerability that allows attackers to read arbitrary system files by manipulating annotation file parameters. Attackers can generate URL-encoded or base64 payloads to include local files through crafted annotation content with file path specifications.

Score

CVSS 4.0 8.7 High

Status

Modified - disclosure@vulncheck.com

Published

2026-01-13

Last modified

2026-03-05

Weaknesses

CWE-98

Affected products

• Wp-mpdf (Fkrauthan)
• Mpdf (Mpdf Project)

References

• https://mpdf.github.io/
• https://www.exploit-db.com/exploits/50995
• https://www.vulncheck.com/advisories/mpdf-local-file-inclusion