9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68428

CVE-2025-68428: jsPDF has Local File Inclusion/Path Traversal vulnerability

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are addImage, html, and addFont. Only the node.js builds of the library are affected, namely the dist/jspdf.node.js and dist/jspdf.node.min.js files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the --permission flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68428

CVE-2025-68428:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jspdf	npm	<= 3.0.4	4.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue within the Node.js environment of the jsPDF library. The root cause lies in the loadFile function and its internal helper nodeReadFile located in src/modules/fileloading.js. Before the patch, the library would take a user-supplied file path, resolve it using path.resolve(), and then read the file using fs.readFileSync(). There was no validation to restrict the path to a specific directory, allowing an attacker to use ../ sequences to navigate the file system and access any file readable by the Node.js process.

The security advisory explicitly mentions that besides loadFile, the functions addImage, html, and addFont are also affected. This is because these functions rely on the same vulnerable file loading mechanism to handle assets like images, HTML resources, and fonts. The provided patch addresses the vulnerability by introducing a security control. It adds a new property, allowFsRead, which acts as a whitelist for file system access. By default, file system access is disabled. The user must now either use Node.js's built-in permission flags (--allow-fs-read) or explicitly define which files and directories jsPDF is allowed to read via the allowFsRead array. The patch also uses fs.realpathSync to resolve the canonical path of a file, making traversal attacks more difficult. Any runtime profile during exploitation would show calls to one of the four identified vulnerable functions.

Vulnerable functions

loadFile

src/modules/fileloading.js

The `loadFile` function in the Node.js environment of jsPDF is vulnerable to path traversal. It takes a file path from the user and, before the patch, would resolve and read the file without proper sanitization. This allows an attacker to provide a crafted path (e.g., `../../../../etc/passwd`) to read arbitrary files from the server's file system. The contents of the file are then embedded into the generated PDF.

addImage

src/modules/addimage.js

The `addImage` function is also a vector for this vulnerability. When a file path is passed to this function to embed an image into the PDF, it internally uses the vulnerable file loading mechanism (`loadFile`). This exposes the same path traversal flaw, allowing an attacker to include arbitrary file contents in place of an image.

html

src/modules/html.js

The `html` function, which is used to render HTML content into a PDF, can also trigger the vulnerability. If the HTML contains references to local files (e.g., in `<img>` tags), the library attempts to load these files using the same vulnerable `loadFile` function, leading to local file inclusion.

addFont

src/modules/addfont.js

The `addFont` function is used to embed custom fonts into a PDF from a file. It uses the same vulnerable `loadFile` mechanism to read the font file from the provided path. This allows an attacker to exploit the path traversal vulnerability to read and embed arbitrary files instead of a font file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.