Volerion logoVolerion
Volerion logoVolerion

FPDF Arbitrary File Upload Vulnerability Allowing Code Execution

Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the AddFont() function of FPDF versions through 1.86. This vulnerability enables attackers to execute arbitrary code by uploading a specially crafted PHP file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where FPDF is used.

Remediation

Users are advised to upgrade to FPDF version 2.6.4 or later.

Added: Feb 3, 2026, 6:45 PM
Updated: Feb 3, 2026, 6:45 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
5.0
exploitability
5.2
remediation
0.0
relevance
2.7
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.