TCPDF vulnerable to attackers triggering deserialization of arbitrary data

CRITICAL 9.8CVE-2018-17057 · GHSA-5hw4-m7f3-hhx8 · Published 14/09/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
fooman/tcpdf Packagist	`< 6.2.22`	`6.2.22`
la-haute-societe/tcpdf Packagist	`< 6.2.22`	`6.2.22`
spoonity/tcpdf Packagist	`< 6.2.22`	`6.2.22`
tecnickcom/tcpdf Packagist	`< 6.2.22`	`6.2.22`
limesurvey limesurvey	`< 3.16.0`	`3.16.0`
tcpdf tecnick	`< 6.2.22`	`6.2.22`

Description

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

NVD description

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.