PT-2026-42033 · Setasign+2 · Fpdi+1

CVE-2026-45802 · Published 2026-05-19 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FPDI versions prior to 2.6.7

Description FPDI is a collection of PHP classes used to read pages from existing PDF documents to serve as templates in FPDF. A Denial of Service (DoS) issue exists where an attacker can upload a small, malicious PDF file, causing the server-side script to crash. This occurs due to memory exhaustion or a script time-out, and repeated attacks can result in sustained service unavailability.

Recommendations Update to version 2.6.7.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-45802

GHSA-2MGW-7Q6P-8GRG

Affected Products

Fpdi

Setasign/Fpdi

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45802.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45802 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45802 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2mgw-7q6p-8grg · Vendor Advisory
• https://github.com/Setasign/FPDI/commit/1695cfcc7e01fe844a7296b3de90855a3fa65be6 · Note
• https://github.com/Setasign/FPDI/security/advisories/GHSA-2mgw-7q6p-8grg · Note
• https://github.com/Setasign/FPDI/releases/tag/v2.6.7 · Note
• https://github.com/Setasign/FPDI · Note
• https://reddit.com/r/VulnMatter/comments/1tiopdo/resumen_diario_de_vulnerabilidades_20052026 · Reddit Post
• https://t.me/CVEtracker/56625 · Telegram Post