30 matches found
CVE-2026-108554
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
EUVD-2026-96348
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
CVE-2026-108554
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
CVE-2026-108554
The software PDFMathTranslate (pdf2zh) versions through 1.9.11 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists within the translate_file handler, which fails to perform scheme or address validation on URLs provided via the Link input of the Gradio Web GUI. This allows unau...
CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
PT-2026-109668
Name of the Vulnerable Software and Affected Versions PDFMathTranslate pdf2zh versions prior to 1.9.12 Description An unauthenticated attacker can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. The issue exists...
CVE-2026-108554: Server-Side Request Forgery (SSRF)
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
PDFMathTranslate server-side request forgeing vulnerability
PDFMathTranslate versions 1.9.11 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the translatefile processor, which passes user URLs from the Link input directly to downloadwithlimit without verifying the protocol or address. This makes it vulnerable t...
babeldoc (>=0.3.38, <=0.3.60), iflow-mcp-pdfmathtranslate-pdf2zh (1.9.11) +3 more potentially affected by CVE-2025-70559 via pdfminer-six (20250416.0.0)
pdfminer-six PYPI version 20250416.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - babeldoc =0.3.38, =1.9.8, =1.9.11 Source cves: CVE-2025-70559 Source advisory: OSV:PYSEC-2026-1761...
babeldoc (>=0.3.38, <=0.3.60), iflow-mcp-pdfmathtranslate-pdf2zh (1.9.11) +3 more potentially affected by CVE-2025-64512 via pdfminer-six (20250416.0.0)
pdfminer-six PYPI version 20250416.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - babeldoc =0.3.38, =1.9.8, =1.9.11 Source cves: CVE-2025-64512 Source advisory: OSV:PYSEC-2026-1762...
Byaidu PDFMathTranslate vulnerable to open redirect
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...
depthflow (0.9.1), f5-tts (1.1.7) +10 more potentially affected by CVE-2026-10783 via gradio (5.35.0)
gradio PYPI version 5.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - depthflow 0.9.1 - f5-tts 1.1.7 - iflow-mcp-pdfmathtranslate-pdf2zh 1.9.11 - mseep-pdf2zh 1.9.11 - paper-reader 0.1.0 - particleanalyzer =0.1.28,...
depthflow (0.9.1), f5-tts (1.1.7) +10 more potentially affected by CVE-2026-28414 via gradio (5.35.0)
gradio PYPI version 5.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - depthflow 0.9.1 - f5-tts 1.1.7 - iflow-mcp-pdfmathtranslate-pdf2zh 1.9.11 - mseep-pdf2zh 1.9.11 - paper-reader 0.1.0 - particleanalyzer =0.1.28,...
babeldoc (>=0.3.38, <=0.3.60), iflow-mcp-pdfmathtranslate-pdf2zh (1.9.11) +3 more potentially affected by CVE-2025-70559 via pdfminer-six (20250416.0.0)
pdfminer-six PYPI version 20250416.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - babeldoc =0.3.38, =1.9.8, =1.9.11 Source cves: CVE-2025-70559 Source advisory: OSV:GHSA-F83H-GHPP-7WCC...
babeldoc (>=0.3.38, <=0.3.60), iflow-mcp-pdfmathtranslate-pdf2zh (1.9.11) +3 more potentially affected by CVE-2025-64512 via pdfminer-six (20250416.0.0)
pdfminer-six PYPI version 20250416.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - babeldoc =0.3.38, =1.9.8, =1.9.11 Source cves: CVE-2025-64512 Source advisory: OSV:GHSA-WF5F-4JWR-PPCP...
CVE-2025-50736
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...
EUVD-2025-37013
Byaidu PDFMathTranslate vulnerable to open redirect...
Byaidu PDFMathTranslate vulnerable to open redirect
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...