mPDF Unsafe Deserialization

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim...

CVE-2019-1000005

CVE-2019-1000005 affects mPDF up to version 7.1.7, where Image/ImageProcessor.getImage() is vulnerable to CWE-502 deserialization of untrusted data via phar:// crafted images, enabling arbitrary code execution or file write. The attack requires hosting a crafted image on the victim server and tri...