PT-2024-36832 · Tcpdf+2 · Tcpdf+2

Published 2024-12-27 · Updated 2025-08-21 · CVE-2024-56527

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TCPDF versions prior to 6.8.0

Description An issue was discovered in the Error function, which lacks an htmlspecialchars call for the error message. This could potentially lead to issues with error message handling.

Recommendations For versions prior to 6.8.0, update to version 6.8.0 or later to resolve the issue. As a temporary workaround, consider disabling the Error function until a patch is available. Restrict access to the Error function to minimize the risk of exploitation. Avoid using the Error function in sensitive areas of the application until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-10864

CVE-2024-56527

DLA-4199-1

DSA-5933-1

GHSA-QX95-CWH6-9MVQ

MGASA-2025-0059

Affected Products

Debian

Red Os

Tcpdf

References · 28

• 🔥 https://andrea0.medium.com/analysis-of-cve-2024-56527-dbdab6962add · Exploit
• https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1 · Patch
• https://osv.dev/vulnerability/DLA-4199-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56527 · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0059 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56527 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-56527 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0059.html · Security Note
• https://osv.dev/vulnerability/GHSA-qx95-cwh6-9mvq · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10864 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZX3ABLKKEVGN4M4BBUJFPBNWW5SHP7J3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56527 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5933-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-56527 · Security Note