TCPDF vulnerable to attackers triggering deserialization of arbitrary data

CRÍTICO 9.8CVE-2018-17057 · GHSA-5hw4-m7f3-hhx8 · Published 14/09/2018 · updated 17/06/2026

En resumen

CVE-2018-17057 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf.
Probabilidad de explotación en los próximos 30 días (EPSS): 26.2%, mayor que el 98.0% de las vulnerabilidades.
Solución: actualizar a 6.2.22, 3.16.0 o posterior.

Package	Affected versions	Patched versions
fooman/tcpdf Packagist	`< 6.2.22`	`6.2.22`
la-haute-societe/tcpdf Packagist	`< 6.2.22`	`6.2.22`
spoonity/tcpdf Packagist	`< 6.2.22`	`6.2.22`
tecnickcom/tcpdf Packagist	`< 6.2.22`	`6.2.22`
limesurvey limesurvey	`< 3.16.0`	`3.16.0`
tcpdf tecnick	`< 6.2.22`	`6.2.22`

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

NVD description

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.