Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.4

BentoPDF may send PDF hash to attacker‑chosen server

CVE-2026-63630 · published 25 days ago
Summary

Versions of BentoPDF up to 2.8.6 let a crafted workflow specify any timestamp server URL. When the workflow runs, the tool sends a fingerprint of the PDF to that URL, letting an attacker learn which document is being used without seeing its contents. Upgrade to version 2.8.7 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
alam00000 bentopdf < 2.8.7
Original advisory text
BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.4 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Sources
CVE-2026-63630 · NVD
CVE-2026-63630 · MITRE
CVE-2026-63630 · OSV
GHSA-cx8x-7rrr-r9x8 · GHSA
Track software like this
Free during beta