CVE-2020-21365
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read...
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
CVE-2020-21365- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
CVE-2020-21365- Updated
- 2026-11-02
EUVDEUVD-2020-14137 No score
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
EUVD-2020-14137- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36cg-hvm7-mhwp
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read...
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
GHSA-36cg-hvm7-mhwp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
CVE-2020-21365- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-21365
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
DEBIAN-CVE-2020-21365- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-21365
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
- Record
UBUNTU-CVE-2020-21365- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2022-0407 No score
Updated wkhtmltopdf packages fix security vulnerability
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations. (CVE-2020-21365)
- Record
MGASA-2022-0407- Updated
- 2026-11-02
OSVUSN-6232-1 No score
wkhtmltopdf vulnerability
It was discovered that wkhtmltopdf was not properly enforcing the same-origin policy when processing certain HTML files. If a user or automated system using wkhtmltopdf were tricked into processing a specially crafted HTML file, an attacker could possibly use this issue to expose sensitive information.
- Record
USN-6232-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wkhtmltopdfDebian:12 |
before 0.12.6-1 | 0.12.6-1 |
wkhtmltopdfDebian:10 |
before 0.12.5-1+deb10u1, plus listed versions 0.12.5-1 |
0.12.5-1+deb10u1 |
wkhtmltopdfMageia:8 |
before 0.12.5-4.1.mga8 | 0.12.5-4.1.mga8 |
wkhtmltopdfUbuntu:Pro:14.04:LTS |
before 0.9.9-4ubuntu0.1~esm1, plus listed versions 0.9.9-4 |
0.9.9-4ubuntu0.1~esm1 |
wkhtmltopdfUbuntu:Pro:16.04:LTS |
before 0.12.2.4-1ubuntu0.1~esm1, plus listed versions 0.12.2.4-1 |
0.12.2.4-1ubuntu0.1~esm1 |
wkhtmltopdfUbuntu:Pro:18.04:LTS |
before 0.12.4-1ubuntu0.1~esm1, plus listed versions 0.12.3.2-30.12.4-1 |
0.12.4-1ubuntu0.1~esm1 |
wkhtmltopdfUbuntu:20.04:LTS |
before 0.12.5-1ubuntu0.1, plus listed versions 0.12.5-10.12.5-1build1 |
0.12.5-1ubuntu0.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | samaellovecraft/CVE-2020-21365 | 2025-06-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-21365 is a high vulnerability (CVSS 7.5) in Wkhtmltopdf, published August 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in wkhtmltopdf 0.12.6-1.