CVE-2025-65875Disclosure(fpdf / fpdf)

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.

fpdf CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://advisories.gitlab.com/pkg/composer/tecnickcom/tc-lib-pdf-font/CVE-2024-56520/

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fpdf

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Affected systems

Vendors

fpdf

Products

fpdf

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

CVE@CVEnew246d
Disclosure
CVE-2025-65875 An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file. https://www.cve.org/CVERecord?id=CVE-2025-65875
Post summary
The text discloses an arbitrary file upload vulnerability in FPDF’s AddFont() function (v1.86 and earlier) that can lead to arbitrary code execution via a crafted PHP file, with no PoC, exploit, patch, or active exploitation mentioned.
00010143
56.5K followersView on X
The Hacker Wire@TheHackerWire246d
Disclosure
🟠 CVE-2025-65875 - High An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file. https://www.thehackerwire.com/vulnerability/CVE-2025-65875/ https://t.co/lXwNz7Cwbp
Post summary
The post announces CVE-2025-65875, detailing an arbitrary file upload flaw in FPDF that could enable remote code execution through a crafted PHP file, but it does not provide a PoC, exploit code, or mention active exploitation or patches.
0001065
113 followersView on X
CVEFind.com@CveFindCom246d
Disclosure
[CVE-2025-65875: HIGH] An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.#cve,CVE-2025-65875,#cybersecurity https://cvefind.com/CVE-2025-65875
Post summary
The text announces a high‑severity arbitrary file upload vulnerability in FPDF’s AddFont() function (v1.86 and earlier), enabling attackers to execute arbitrary code via crafted PHP uploads, but provides no PoC, exploit, or mitigation details.
0000063
583 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fpdf	fpdf	1.8.6	-	-

Explore more

Back to dashboard fpdf CVEs fpdf vulnerabilities

What researchers are saying

CVE-2025-65875

CVE@CVEnewDisclosure

The text discloses an arbitrary file upload vulnerability in FPDF’s AddFont() function (v1.86 and earlier) that can lead to arbitrary code execution via a crafted PHP file, with no PoC, exploit, patch, or active exploitation mentioned.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2025-65875, detailing an arbitrary file upload flaw in FPDF that could enable remote code execution through a crafted PHP file, but it does not provide a PoC, exploit code, or mention active exploitation or patches.

CVEFind.com@CveFindComDisclosure

The text announces a high‑severity arbitrary file upload vulnerability in FPDF’s AddFont() function (v1.86 and earlier), enabling attackers to execute arbitrary code via crafted PHP uploads, but provides no PoC, exploit, or mitigation details.