critical
CVE-2018-17057
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Ubuntu (medium).
Description
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf and 1 more | 6.2.22 |
| composer::PHP Security Advisories Database | fooman/tcpdf, fossar/tcpdf-parser, la-haute-societe/tcpdf and 3 more | no fix listed |
| debian 11 | tcpdf | 6.2.26+dfsg-1 |
| debian 12 | tcpdf | 6.2.26+dfsg-1 |
| debian 13 | tcpdf | 6.2.26+dfsg-1 |
| debian 14 | tcpdf | 6.2.26+dfsg-1 |
| debian 8 | tcpdf | no fix listed |
| debian 9 | tcpdf | no fix listed |
| echo | tcpdf | 6.2.26+dfsg-1 |
| ubuntu 18.04-ESM | tcpdf | no fix listed |
| ubuntu 20.04-ESM | tcpdf | no fix listed |
| ubuntu 22.04 | tcpdf | no fix listed |
Show all 20 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | fooman/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | la-haute-societe/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | spoonity/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | tecnickcom/tcpdf | 6.2.22 |
| composer::PHP Security Advisories Database | fooman/tcpdf | no fix listed |
| composer::PHP Security Advisories Database | fossar/tcpdf-parser | no fix listed |
| composer::PHP Security Advisories Database | la-haute-societe/tcpdf | no fix listed |
| composer::PHP Security Advisories Database | spoonity/tcpdf | no fix listed |
| composer::PHP Security Advisories Database | tecnickcom/tcpdf | no fix listed |
| composer::PHP Security Advisories Database | wallabag/tcpdf | no fix listed |
| debian 11 | tcpdf | 6.2.26+dfsg-1 |
| debian 12 | tcpdf | 6.2.26+dfsg-1 |
| debian 13 | tcpdf | 6.2.26+dfsg-1 |
| debian 14 | tcpdf | 6.2.26+dfsg-1 |
| debian 8 | tcpdf | no fix listed |
| debian 9 | tcpdf | no fix listed |
| echo | tcpdf | 6.2.26+dfsg-1 |
| ubuntu 18.04-ESM | tcpdf | no fix listed |
| ubuntu 20.04-ESM | tcpdf | no fix listed |
| ubuntu 22.04 | tcpdf | no fix listed |
References
- http://packetstormsecurity.com/files/152200/TCPDF-6.2.19-Deserialization-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/152360/LimeSurvey-Deserialization-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2019/Mar/36
- https://contao.org/en/news/security-vulnerability-cve-2018-17057.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/fooman/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/la-haute-societe/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/spoonity/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/tecnickcom/tcpdf/CVE-2018-17057.yaml
All 17 references
- https://github.com/FriendsOfPHP/security-advisories/blob/master/wallabag/tcpdf/CVE-2018-17057.yaml
- https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a5
- https://github.com/tecnickcom/TCPDF
- https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26e
- https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26ed
- https://nvd.nist.gov/vuln/detail/CVE-2018-17057
- https://www.cve.org/CVERecord?id=CVE-2018-17057
- https://www.exploit-db.com/exploits/46634
- https://www.exploit-db.com/exploits/46634/