CVE-2025-65875
📋 TL;DR
This CVE describes an arbitrary file upload vulnerability in FPDF's AddFont() function that allows attackers to upload malicious PHP files. Successful exploitation could lead to remote code execution on affected systems. Organizations using FPDF v1.86 or earlier for PDF generation with font handling capabilities are at risk.
💻 Affected Systems
- FPDF
📦 What is this software?
Fpdf by Fpdf
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, data exfiltration, and lateral movement within the network.
Likely Case
Web server compromise leading to defacement, data theft, or deployment of additional malware payloads.
If Mitigated
Attack blocked at web application firewall level or file upload validation prevents malicious file execution.
🎯 Exploit Status
Exploitation requires ability to upload files to the AddFont() function endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.87 or later
Vendor Advisory: http://www.fpdf.org
Restart Required: No
Instructions:
1. Update FPDF to version 1.87 or later. 2. Replace the FPDF library files in your application. 3. Test PDF generation functionality.
🔧 Temporary Workarounds
Implement file upload validation
allAdd server-side validation to restrict uploaded files to specific font formats only
Disable AddFont() functionality
allRemove or disable the AddFont() function if not required
🧯 If You Can't Patch
- Implement strict file upload validation allowing only .ttf, .otf, and .pfb font files
- Deploy web application firewall rules to block PHP file uploads to the affected endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your application uses FPDF version 1.86 or earlier and has the AddFont() function enabled.Check Version:
Check the fpdf.php file header for version information or use composer show tecnickcom/tcpdfVerify Fix Applied:
Verify FPDF version is 1.87 or later and test that PHP file uploads to AddFont() endpoint are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to AddFont endpoint
- PHP file upload attempts with font-related filenames
- Web server error logs showing file permission issues
Network Indicators:
- POST requests to AddFont endpoints with PHP file content
- Unusual outbound connections from web server after file upload
SIEM Query:
source="web_server" AND (uri="*AddFont*" OR uri="*addfont*") AND (file_extension="php" OR file_extension="phtml")