CVE WatchJul 5, 2026

CVE-2025-56590

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to

CVSS

9.8

Critical

EPSS

0.5%

p39

KEV

—

Exploit Today

0-100

Published: Jan 22, 2026 · Last modified: Jul 5, 2026 · CWE-78

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-06-302026-07-17

Technical description

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server.

Official references

www.stratascale.comhttps://www.stratascale.com/resource/apryse-server-argument-injection-rce/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2024-121210.0 CRI

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability5d CVE-2026-398089.8 CRI

99.7%

KEV—80Fortinet FortiSandbox OS Command Injection Vulnerability1d CVE-2022-262589.8 CRI

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability9d CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability3d CVE-2021-252988.8 HIG

99.5%

KEV—80Nagios XI OS Command Injection9d