com.itextpdf/itextpdf vulnerabilities

Latest com.itextpdf/itextpdf CVEs

Newest publication first

1. CVE-2021-43113 Command injection in itext7-core

   Published 2021-12-15

   Critical·CVSS 9.8 EPSS 5.4%

   iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

2. CVE-2017-9096 Improper Restriction of XML External Entity Reference in iText

   Published 2017-11-08

   High·CVSS 8.8 EPSS 9.6%

   The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.