---
id: CVE-2026-114491
title: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
summary: >-
  pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy()
  restriction to images referenced inside SVG content, allowing attackers to
  read blocked local files. Attackers supplying a document definition can add an
  SVG image hre…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-73
vendor: bpampuch
product: pdfmake
affected:
  - pdfmake >= 0.3.8 < 0.3.12
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T17:54:16.217Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114491'
references:
  - url: >-
      https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
  - url: 'https://github.com/bpampuch/pdfmake/releases/tag/0.3.12'
    label: pdfmake 0.3.12 Release Notes
  - url: 'https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372'
  - url: >-
      https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images
    label: >-
      VulnCheck Advisory: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass
      via SVG Images
tags:
  - cve.org
ingestedAt: '2026-10-21T18:09:27.270Z'
---

## Overview

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

## Affected

- `pdfmake >= 0.3.8 < 0.3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.