PT-2026-3989 · Apryse · Apryse Html2Pdf Sdk

Published 2026-01-22 · Updated 2026-02-02 · CVE-2025-56589

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apryse HTML2PDF SDK versions through 11.6.0

Description A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) issue exists in the InsertFromHtmlString() function. These issues could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Exploitation of these issues could lead to the disclosure of sensitive data or potential system takeover. A Server-Side Request Forgery (SSRF) is a web security flaw that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing. A Local File Inclusion (LFI) is a web security flaw that allows an attacker to include files on the web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-56589

Affected Products

Apryse Html2Pdf Sdk

References · 6

• 🔥 https://stratascale.com/resource/apryse-server-module-ssrf-lfi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56589 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56589 · Vendor Advisory
• https://twitter.com/CVEnew/status/2015448715960410138 · Twitter Post
• https://t.me/cveNotify/150640 · Telegram Post
• http://apryse.com · Note