Every CVE Search/ Get API key

CVE-2024-56527

TCPDF missing character escape on error messages

7.5 HighFix available

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.76%Up 0.7 points since Dec 28, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
CVE-2024-56527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-3609 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
EUVD-2024-3609
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qx95-cwh6-9mvq 4.8

TCPDF missing character escape on error messages

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
GHSA-qx95-cwh6-9mvq
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
CVE-2024-56527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-79
Updated
2026-11-02
OSV 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
CVE-2024-56527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2024-56527 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
DEBIAN-CVE-2024-56527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-qx95-cwh6-9mvq 4.8

TCPDF missing character escape on error messages

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
GHSA-qx95-cwh6-9mvq
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2024-56527 7.5

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

Record
UBUNTU-CVE-2024-56527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2025-0059 No score

Updated php-tcpdf packages fix security vulnerabilities

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. (CVE-2024-56522) An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. (CVE-2024-56527)

Record
MGASA-2025-0059
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tecnickcom/tcpdf
Packagist
 before 6.8.0
6.8.0
tcpdf
Debian:12
 before 6.6.2+dfsg1-1+deb12u1, plus listed versions
6.6.2+dfsg1-1
6.6.2+dfsg1-1+deb12u1
tcpdf
Debian:13
 before 6.8.0+dfsg-1
6.8.0+dfsg-1
tcpdf
Debian:14
 before 6.8.0+dfsg-1
6.8.0+dfsg-1
tcpdf
Debian:11
From an advisory covering 8 CVEs
 before 6.3.5+dfsg1-1+deb11u1, plus listed versions
6.3.5+dfsg1-1
6.3.5+dfsg1-1+deb11u1
tcpdf
Debian:12
From an advisory covering 8 CVEs
 before 6.6.2+dfsg1-1+deb12u1, plus listed versions
6.6.2+dfsg1-1
6.6.2+dfsg1-1+deb12u1
tecnickcom/tcpdf
Packagist
 before 6.8.0, plus listed versions
6.0.0136.0.0146.0.0156.0.0166.0.017
Show 45 moreShow less
6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062
6.8.0
php-tcpdf
Mageia:9
From an advisory covering 4 CVEs
 before 6.5.0-1.3.mga9
6.5.0-1.3.mga9
tcpdf
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2
 None known
tcpdf
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.0.093+dfsg-16.0.093+dfsg-1ubuntu1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
tcpdf
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1
 None known
tcpdf
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1
 None known
tcpdf
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1
 None known
tcpdf
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.6.2+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56527 is a high vulnerability (CVSS 7.5) in Tcpdf Project Tcpdf, published December 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in tecnickcom/tcpdf 6.8.0.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 81 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open