https://sanidhya.tech/posts/Recent content in Work on Sanidhya SoniHugoen-usSun, 01 Feb 2026 00:00:00 +0000https://sanidhya.tech/posts/security-research/cve-2025-65875-fpdf-rce-vulnerability/Sun, 01 Feb 2026 00:00:00 +0000https://sanidhya.tech/posts/security-research/cve-2025-65875-fpdf-rce-vulnerability/<p><strong>By Sanidhya Soni</strong> | <em>February 01, 2026</em></p> <p><strong>Affected:</strong> FPDF <strong>≤ 1.86</strong></p> <p><strong>Vector:</strong> Remote code execution</p> <p><strong>Severity</strong>: High</p> <p><strong>Exploit prerequisites:</strong> The target application must allow an attacker to <strong>influence the file path</strong> passed to <code>AddFont()</code> (commonly via “custom font upload” features)</p> <hr> <h2 id="summary">Summary</h2> <p>FPDF font definition files are PHP and are loaded using include(). If an application allows untrusted uploads to become font definition files, or allows attacker control of the path passed into AddFont(), the attacker can execute PHP. This is an insecure integration pattern, not a vulnerability in FPDF’s default behavior.</p>