CVE-2017-6100
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
CVE-2017-6100- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
CVE List No score
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
CVE-2017-6100- Updated
- 2026-11-02
EUVDEUVD-2017-15165 No score
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
EUVD-2017-15165- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xv34-wq27-w2wm
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
GHSA-xv34-wq27-w2wm- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSV
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
CVE-2017-6100- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6100
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
DEBIAN-CVE-2017-6100- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6100
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Record
UBUNTU-CVE-2017-6100- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0067 No score
Updated php-tcpdf packages fix security vulnerability
A local file inclusion vulnerability in TCPDF allows to upload files from the server generating PDF files to an external FTP server (CVE-2017-6100).
The updated php-tcpdf-6.0.098-1.1.mga5 package fixes this issue by setting K_TCPDF_CALLS_IN_HTML configuration parameter to false by default.
- Record
MGASA-2017-0067- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tcpdfDebian:12 |
before 6.2.12+dfsg2-1 | 6.2.12+dfsg2-1 |
tcpdfDebian:13 |
before 6.2.12+dfsg2-1 | 6.2.12+dfsg2-1 |
tcpdfDebian:14 |
before 6.2.12+dfsg2-1 | 6.2.12+dfsg2-1 |
php-tcpdfMageia:5 |
before 6.0.098-1.1.mga5 | 6.0.098-1.1.mga5 |
tcpdfUbuntu:14.04:LTS |
All versions, plus listed versions 6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2 |
None known |
tcpdfUbuntu:16.04:LTS |
All versions, plus listed versions 6.0.093+dfsg-16.0.093+dfsg-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6100 is a high vulnerability (CVSS 7.5) in Tcpdf Project Tcpdf, published February 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in tcpdf 6.2.12+dfsg2-1.