Suggestions search

All statuses

Filter by:

With package: pdfding

Found 2 matching suggestions

View:

Compact

Detailed

Published

Permalink CVE-2026-34376

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): NONE
Availability impact (A): NONE

updated 15 hours ago by @LeSuisse Activity log

Created automatic suggestion 18 hours ago
@LeSuisse accepted 15 hours ago
@LeSuisse published on GitHub 15 hours ago

PdfDing: Password-protected share bypass via direct serve endpoint

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without completing the password verification flow. This results in unauthorized access to confidential documents that users expected to be protected by a shared-link password. This issue has been patched in version 1.7.0.

References

https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3 x_refsource_CONFIRM
https://github.com/mrmn2/PdfDing/pull/294 x_refsource_MISC
https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a x_refsource_MISC
https://github.com/mrmn2/PdfDing/releases/tag/v1.7.0 x_refsource_MISC

Affected products

PdfDing

==< 1.7.0

Matching in nixpkgs

pkgs.pdfding

Selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices

nixos-unstable 1.5.1
- nixpkgs-unstable 1.5.1
- nixos-unstable-small 1.5.1

Package maintainers

@ethancedwards8 Ethan Carter Edwards <ethan@ethancedwards.com>
@Prince213 Sizhe Zhao <prc.zhao@outlook.com>
@wegank Weijia Wang <contact@weijia.wang>
@phanirithvij Phani Rithvij <phanirithvij2000@gmail.com>
@eljamm Fedi Jamoussi <fedi.jamoussi@protonmail.ch>

Advisory: https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3
Patch: https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a

Published

Permalink CVE-2026-34586

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): NONE
Availability impact (A): NONE

updated 1 day, 14 hours ago by @LeSuisse Activity log

Created automatic suggestion 1 day, 18 hours ago
@LeSuisse accepted 1 day, 15 hours ago
@LeSuisse published on GitHub 1 day, 14 hours ago

PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_allowed() validates only session existence — it does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1.