CVE Intelligence
Analysis AI-assisted

CVE-2025-65875: FPDF AddFont() Arbitrary File Upload Leading to Code Execution

CVE-2025-65875 is an arbitrary file upload weakness in the AddFont() function of FPDF v1.86 and earlier, classified as CWE-434. According to the NVD description, an attacker can execute arbitrary code by uploading a crafted PHP file. NVD rates it 9.8 Critical under CVSS v3.1, while the MITRE CNA record gives 8.8, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-65875 describes an arbitrary file upload weakness in the AddFont() function of FPDF. According to the NVD description, an attacker can execute arbitrary code by uploading a crafted PHP file. The weakness is mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Impact

  • The published description states that successful exploitation allows arbitrary code execution.
  • NVD scores the issue 9.8 (Critical) under CVSS v3.1, with network attack vector, low complexity, no privileges and no user interaction required.
  • The MITRE CNA record assigns 8.8 under CVSS v3.1, so the scores differ by source.

Affected products and versions

  • The description refers to FPDF v1.86 and earlier.
  • The structured affected entry lists version 1.8.6 for the product Fpdf Fpdf. These two version expressions do not clearly match, so the exact affected range should be confirmed with the vendor or project.
  • The record contains no fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted for this analysis. No EPSS score is available in the record.

Remediation and mitigation

  • Inventory every application that uses FPDF, including copies bundled inside other projects.
  • Check the project repository and the project site for current releases and maintainer guidance. No fix is listed in the record.
  • Until a verified fixed version is in place, restrict upload functionality, validate file types on the server side, store uploads outside the web root or in directories where scripts cannot run, and limit write permissions.
  • Review whether any PDF generation workflow accepts user-supplied font files or paths.

Detection guidance

  • Monitor upload endpoints and storage directories for unexpected server-side script files with executable extensions.
  • Review web server logs for requests to recently uploaded files in upload directories.
  • Alert when the web server process creates new files in directories that should only hold static content.

Limitations of the available information

The record does not provide a fixed version, a vulnerable version range that reconciles the description with the affected entry, exploitation evidence, or EPSS data. The GitHub advisory referenced for tc-lib-pdf-font under CVE-2024-56520 concerns a different identifier and package, and its relationship to this CVE is not established by the record. Details of the vulnerable code path are not in the sources consulted.

Frequently asked questions

What is CVE-2025-65875?

It is an arbitrary file upload weakness in the AddFont() function of FPDF v1.86 and earlier, which according to the NVD description can lead to arbitrary code execution through a crafted PHP file.

Is this CVE known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

Is a fixed version available?

The record does not list a fixed version. Check the official FPDF project pages and confirm with maintainers before assuming a fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.