Pdfmathtranslate
Monthly
Server-side request forgery in PDFMathTranslate (pdf2zh) through 1.9.11 lets unauthenticated remote attackers force the server to fetch arbitrary URLs supplied through the Gradio web GUI's Link (translate-from-URL) input, reaching internal services and cloud metadata endpoints with the fetched content returned inside the generated PDF. The flaw exists because the translate_file handler forwards user-controlled URLs to download_with_limit without validating the URL scheme or destination address, and the CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are needed. Exploitation is gated primarily by exposure: the Gradio interface must be network-reachable and able to route to internal or link-local addresses, and impact is confined to information disclosure (VC:L, no integrity or availability effect) - there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Server-side request forgery in PDFMathTranslate (pdf2zh) through 1.9.11 lets unauthenticated remote attackers force the server to fetch arbitrary URLs supplied through the Gradio web GUI's Link (translate-from-URL) input, reaching internal services and cloud metadata endpoints with the fetched content returned inside the generated PDF. The flaw exists because the translate_file handler forwards user-controlled URLs to download_with_limit without validating the URL scheme or destination address, and the CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are needed. Exploitation is gated primarily by exposure: the Gradio interface must be network-reachable and able to route to internal or link-local addresses, and impact is confined to information disclosure (VC:L, no integrity or availability effect) - there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.