CVE-2018-17057

TCPDF vulnerable to attackers triggering deserialization of arbitrary data

9.8 CriticalPublic exploitFix available

CVE-2018-17057 is a critical vulnerability (CVSS 9.8) in Tecnick Tcpdf, published September 14, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 26.2%, the 97th percentile. Fixed in tecnickcom/tcpdf 6.2.22.

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

26.2%Up 19.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: CVE-2018-17057
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: CVE-2018-17057
Updated: 2026-11-02

EUVDEUVD-2022-7027 No score

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: EUVD-2022-7027
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5hw4-m7f3-hhx8 9.8

TCPDF vulnerable to attackers triggering deserialization of arbitrary data

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: GHSA-5hw4-m7f3-hhx8
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: CVE-2018-17057
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-17057 9.8

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: DEBIAN-CVE-2018-17057
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-5hw4-m7f3-hhx8 9.8

TCPDF vulnerable to attackers triggering deserialization of arbitrary data

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: GHSA-5hw4-m7f3-hhx8
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-17057 9.8

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Record: UBUNTU-CVE-2018-17057
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tecnickcom/tcpdf` Packagist	before 6.2.22	6.2.22
`fooman/tcpdf` Packagist	before 6.2.22	6.2.22
`la-haute-societe/tcpdf` Packagist	before 6.2.22	6.2.22
`spoonity/tcpdf` Packagist	before 6.2.22	6.2.22
`tcpdf` Debian:12	before 6.2.26+dfsg-1	6.2.26+dfsg-1
`tcpdf` Debian:13	before 6.2.26+dfsg-1	6.2.26+dfsg-1
`tcpdf` Debian:14	before 6.2.26+dfsg-1	6.2.26+dfsg-1
`tecnickcom/tcpdf` Packagist	before 6.2.22, plus listed versions 6.0.0136.0.0146.0.0156.0.0166.0.017 Show 45 moreShow less 6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062	6.2.22
`fooman/tcpdf` Packagist	before 6.2.22, plus listed versions 6.0.0136.0.0146.0.0156.0.0166.0.017 Show 45 moreShow less 6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062	6.2.22
`la-haute-societe/tcpdf` Packagist	before 6.2.22, plus listed versions 6.0.0136.0.0146.0.0156.0.0166.0.017 Show 45 moreShow less 6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062	6.2.22

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`spoonity/tcpdf` Packagist	before 6.2.22, plus listed versions 6.0.0136.0.0146.0.0156.0.0166.0.017 Show 45 moreShow less 6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062	6.2.22
`tcpdf` Ubuntu:14.04:LTS	All versions, plus listed versions 6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2	None known
`tcpdf` Ubuntu:16.04:LTS	All versions, plus listed versions 6.0.093+dfsg-16.0.093+dfsg-1ubuntu1	None known
`tcpdf` Ubuntu:18.04:LTS	All versions, plus listed versions 6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1	None known
`tcpdf` Ubuntu:20.04:LTS	All versions, plus listed versions 6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1	None known
`tcpdf` Ubuntu:22.04:LTS	All versions, plus listed versions 6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1	None known