CVE-2026-108554: pdf2zh: unauthenticated SSRF via Link input

MEDIUMCISA: TRACK*

Published October 10, 2026

CISO Take

PDFMathTranslate (pdf2zh) through 1.9.11 has a server-side request forgery flaw in its Gradio web GUI: the translate_file handler passes a user-supplied URL to a download routine without checking the scheme or destination address. An unauthenticated attacker can make the server fetch internal URLs, including cloud metadata endpoints, and get back any PDF content it returns. The CVSS score is a moderate 5.3 (confidentiality only), there is no known public exploit, no KEV listing, and no EPSS score yet, so near-term mass exploitation looks unlikely. Exposure is the real risk: any internet-facing or shared-network pdf2zh GUI on a cloud VM can become a pivot toward internal services, and metadata access can escalate if instance roles are broad. No patched version is listed, so inventory deployments, restrict the GUI to trusted networks or put it behind authentication, and enforce IMDSv2 and egress filtering until the maintainers fix it (see GitHub issue #1188).

Sources:NVDVulnCheckGitHubATLAS

What is the risk?

Medium. Exploitation is trivial (network, low complexity, no privileges, no user interaction), but impact is limited to confidentiality of data reachable through the server's network position. Only responses that are valid PDFs are likely to be returned in full, which narrows direct data theft. Risk increases sharply on cloud hosts with IMDSv1 or over-privileged instance roles, or when the tool runs inside sensitive internal networks. No exploit is public, no KEV entry exists and EPSS is unavailable, so the likelihood is uncertain. Confidence in the facts is HIGH (NVD and VulnCheck advisory); confidence in the real-world exploitation estimate is LOW.

How does the attack unfold?

Initial Access

Attacker reaches an exposed pdf2zh Gradio GUI that requires no authentication.

AML.T0049

Exploitation

Attacker submits a Link pointing to an internal host or metadata endpoint, which the server fetches without validation.

AML.T0049

Discovery

Attacker enumerates internal services and cloud metadata through the server's responses.

AML.T0075

Impact

Attacker retrieves returned PDF content and possibly credentials, enabling follow-on access to cloud and AI resources.

Initial Access

Attacker reaches an exposed pdf2zh Gradio GUI that requires no authentication.

AML.T0049

Exploitation

Attacker submits a Link pointing to an internal host or metadata endpoint, which the server fetches without validation.

AML.T0049

Discovery

Attacker enumerates internal services and cloud metadata through the server's responses.

AML.T0075

Impact

Attacker retrieves returned PDF content and possibly credentials, enabling follow-on access to cloud and AI resources.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gradio	pip	—	No patch
43.9KOpenSSF 5.9731 dependentsPushed 8d ago29% patched~108d to patchFull package profile →
PDFMathTranslate	pip	—	No patch
37.8K1 dependentsPushed 6d ago0% patchedFull package profile →
PDFMathTranslate	—	—	No patch

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) No patched version is listed; check the PDFMathTranslate repository and issue #1188 for a fix and upgrade once available. 2) Do not expose the pdf2zh Gradio GUI to the internet; bind it to localhost or a trusted VPN, or place it behind an authenticating reverse proxy. 3) Block outbound requests from the host to link-local (169.254.169.254), loopback, and RFC1918 ranges using egress firewall rules or network policies. 4) Enforce IMDSv2 with a hop limit of 1 and minimize instance role permissions. 5) Detection: review web and proxy logs for Link inputs pointing to internal IPs, metadata addresses, or unusual schemes, and alert on unexpected outbound connections from the translation host. 6) Do not use the Link input feature; disable it if possible, or patch the code to validate scheme and resolved IP before fetching.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionFrameworkAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-108554?

Is CVE-2026-108554 actively exploited?

No confirmed active exploitation of CVE-2026-108554 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108554?

1) No patched version is listed; check the PDFMathTranslate repository and issue #1188 for a fix and upgrade once available. 2) Do not expose the pdf2zh Gradio GUI to the internet; bind it to localhost or a trusted VPN, or place it behind an authenticating reverse proxy. 3) Block outbound requests from the host to link-local (169.254.169.254), loopback, and RFC1918 ranges using egress firewall rules or network policies. 4) Enforce IMDSv2 with a hop limit of 1 and minimize instance role permissions. 5) Detection: review web and proxy logs for Link inputs pointing to internal IPs, metadata addresses, or unusual schemes, and alert on unexpected outbound connections from the translation host. 6) Do not use the Link input feature; disable it if possible, or patch the code to validate scheme and resolved IP before fetching.

What systems are affected by CVE-2026-108554?

This vulnerability affects the following AI/ML architecture patterns: Document processing pipelines, Self-hosted AI translation services, Gradio-based web GUIs, Cloud-hosted ML tooling.

What is the CVSS score for CVE-2026-108554?

CVE-2026-108554 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

Document processing pipelinesSelf-hosted AI translation servicesGradio-based web GUIsCloud-hosted ML tooling

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.

Exploitation Scenario

An attacker finds an internet-exposed pdf2zh Gradio instance running on a cloud VM. They submit a Link value pointing at an internal service or the cloud metadata endpoint. The server fetches the URL with no scheme or address validation and returns the content, or the PDF it produces. The attacker repeats this to map internal services and, if the metadata service responds, to harvest instance role credentials. They then use those credentials to reach cloud storage or model-serving resources tied to the AI workload.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.