Cve-2025-68428 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2025-68428/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 18:59:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgjsPDF: Path traversal and local file inclusion (CVE-2025-68428)https://feed.craftedsignal.io/briefs/2026-10-jspdf-lfi/Fri, 30 Oct 2026 18:59:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jspdf-lfi/A critical path traversal and local file inclusion vulnerability in jsPDF versions prior to 4.0.0 allows unauthenticated attackers to read arbitrary files in Node.js server-side environments.CVE-2025-68428 is a critical vulnerability in the jsPDF library (versions < 4.0.0) affecting Node.js implementations. The vulnerability arises when user-controlled input is passed to server-side file-loading functions, enabling path traversal and unauthorized local file inclusion (LFI). Attackers can leverage this to read sensitive files from the server's filesystem.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the affected Node.js application, potentially leading to the disclosure of sensitive configuration files, source code, or credentials.

Recommendation

  • Upgrade jsPDF to version 4.0.0 or later immediately.
  • Audit server-side code to identify instances where user-supplied input is passed to jsPDF functions like 'loadFile', 'addImage', 'addFont', or 'html()'.
  • Implement strict allowlisting for file paths and parameters used in PDF generation endpoints.
  • Review Node.js filesystem access permissions and ensure the process runs with the principle of least privilege.
  • Use the asset discovery phase to identify where the library is in use across the environment to prioritize patching.
]]>criticaladvisorypath-traversallocal-file-inclusionnodejsvulnerabilitycve-2025-68428