CVE-2024-56527: TCPDF XSS Vulnerability

CVE-2024-56527 Overview

CVE-2024-56527 is a cross-site scripting (XSS) vulnerability affecting TCPDF, a widely used PHP library for generating PDF documents. The flaw exists in the Error function, which fails to apply an htmlspecialchars call to error messages before rendering them. Attackers can inject arbitrary HTML or JavaScript through error message output when user-controlled input reaches the function. The issue affects TCPDF versions prior to 6.8.0 and is tracked under [CWE-79].

Critical Impact

Unsanitized error output in TCPDF allows attackers to deliver reflected XSS payloads to users of applications that surface library error messages, with availability impact rated High under the CVSS vector.

Affected Products

• TCPDF versions before 6.8.0
• PHP applications embedding tcpdf_project:tcpdf for PDF generation
• Debian LTS distributions packaging vulnerable TCPDF releases

Discovery Timeline

• 2024-12-27 - CVE-2024-56527 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-56527

Vulnerability Analysis

The vulnerability resides in the Error method of the TCPDF class. When TCPDF encounters a runtime issue, this function emits an error string back to the calling context. The function concatenates the message directly into output without escaping HTML metacharacters such as <, >, or ".

When attacker-controlled input flows into a TCPDF call that subsequently triggers an error — for example, malformed image paths, unsupported fonts, or invalid HTML constructs passed to writeHTML — the unsanitized message is reflected to the browser. This enables reflected XSS in any web application that exposes TCPDF error output to end users. The vulnerability scope and exploitation details are documented in the Medium analysis of CVE-2024-56527.

Root Cause

The root cause is missing output encoding in the Error function. TCPDF historically assumed error messages were developer-controlled strings, not attacker-influenced data. Because TCPDF processes user-supplied HTML and resource paths, attacker input can reach the error path and propagate to the response untouched. The maintainers addressed the gap by wrapping the message in htmlspecialchars in version 6.8.0, as shown in the upstream commit.

Attack Vector

An attacker submits crafted input — such as an image URL, HTML attribute, or font reference — to a web application using TCPDF. The input causes TCPDF to invoke Error with attacker-controlled fragments embedded in the message. The browser then renders the reflected payload, executing JavaScript in the victim's session context. Exploitation requires no authentication and uses standard HTTP requests over the network.

No public exploit or CISA KEV listing exists for this CVE. The current EPSS probability is 0.469%.

Detection Methods for CVE-2024-56527

Indicators of Compromise

• HTTP requests containing HTML or JavaScript metacharacters (<script, onerror=, javascript:) in parameters that feed TCPDF input such as image sources, HTML bodies, or filenames
• Application or web server error logs showing TCPDF Error invocations with reflected user input
• Outbound requests from victim browsers to attacker-controlled domains immediately after PDF generation endpoints are accessed

Detection Strategies

• Inventory all PHP applications and identify those bundling TCPDF below version 6.8.0 via composer.lock files or vendored copies
• Static analysis of application code to locate call sites where untrusted input reaches TCPDF methods such as writeHTML, Image, or AddFont
• Inspect HTTP response bodies from PDF generation endpoints for unescaped < or > characters within TCPDF error strings

Monitoring Recommendations

• Configure web application firewall rules to flag XSS payloads targeting PDF generation endpoints
• Forward PHP error logs to a centralized SIEM and alert on TCPDF ERROR strings containing HTML tags
• Track outbound DNS and HTTP requests from session contexts that recently rendered PDF preview pages

How to Mitigate CVE-2024-56527

Immediate Actions Required

• Upgrade TCPDF to version 6.8.0 or later across all PHP applications and dependency manifests
• Audit all entry points that pass user input to TCPDF rendering functions and apply input validation upstream
• Restrict who can submit data to PDF generation endpoints by enforcing authentication and rate limits

Patch Information

The upstream fix lands in TCPDF 6.8.0. The maintainer commit 11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1 introduces an htmlspecialchars call around the error message in the Error function. Review the TCPDF version comparison between 6.7.8 and 6.8.0 and the Debian LTS security announcement for distribution-specific package updates.

Workarounds

• Apply a local patch to wrap the Error function message argument with htmlspecialchars($msg, ENT_QUOTES, 'UTF-8') if upgrading is not immediately feasible
• Set a strict Content Security Policy disallowing inline scripts on pages that surface TCPDF output
• Configure the application to render TCPDF errors only in server-side logs and return a generic error page to the client

# Configuration example
composer require tecnickcom/tcpdf:^6.8.0
composer update tecnickcom/tcpdf
php -r "require 'vendor/autoload.php'; echo TCPDF_STATIC::getTCPDFVersion();"