CVE Feed

    Dashboard / CVE / CVE-2024-22641

    CVE-2024-22641

    TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

    Published:May 28, 2024
    Last Modified:Nov 3, 2025
    EPS:May 28, 2024
    EPSS Score:0.11044
    CVSS Score:7.5

    Affected Products

    Vendor
    Tcpdf Project
    Product
    Tcpdf

    Exploits

    https://github.com/zunak/CVE-2024-22641https://github.com/zunak/CVE-2024-22641https://github.com/zunak/CVE-2024-22641

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2024-56521 (CVSS 9.8) — An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERI…
    CVE-2024-56522 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not…
    CVE-2024-56527 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error…
    CVE-2024-56519 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.…
    CVE-2024-51058 (CVSS 6.2) — Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user…
    CVE-2024-22640 (CVSS 7.5) — TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HT…
    CVE-2024-32489 (CVSS 6.1) — TCPDF before 6.7.4 mishandles calls that use HTML syntax.…
    CVE-2017-6100 (CVSS 7.5) — tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High