MEDIUM
GHSA-qx95-cwh6-9mvq
TCPDF missing character escape on error messages
Quick fix
GHSA-qx95-cwh6-9mvq — tecnickcom/tcpdf: upgrade to the fixed version with the command below.
composer require tecnickcom/tcpdf:^6.8.0Details
An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/tecnickcom/tcpdf
Introduced in:
0Fixed in: 6.8.0Fix
composer require tecnickcom/tcpdf:^6.8.0References
- https://nvd.nist.gov/vuln/detail/CVE-2024-56527[ADVISORY]
- https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1[WEB]
- https://andrea0.medium.com/analysis-of-cve-2024-56527-dbdab6962add[WEB]
- https://github.com/tecnickcom/TCPDF[PACKAGE]
- https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0[WEB]
- https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html[WEB]
- https://tcpdf.org[WEB]