CVE-2026-34586

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_allowed() validates only session existence — it does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1.

• CWE-863

• https://github.com/mrmn2/PdfDing/commit/a6783b259b25c839c52c6f2380333827a52e89ebPatch
• https://github.com/mrmn2/PdfDing/releases/tag/v1.7.1Product, Release Notes
• https://github.com/mrmn2/PdfDing/security/advisories/GHSA-vfqx-2464-38wfExploit, Mitigation, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34579Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-34580Botan is a C++ cryptography library. In 3.11.0, the function…7.5
• CVE-2026-34581goshs is a SimpleHTTPServer written in Go. From version 1.1.…8.1
• CVE-2026-34582Botan is a C++ cryptography library. Prior to version 3.11.1…9.1
• CVE-2026-34584listmonk is a standalone, self-hosted, newsletter and mailin…5.4
• CVE-2026-34585SiYuan is a personal knowledge management system. Prior to v…8.2
• CVE-2026-34587Kirby is an open-source content management system. Prior to …8.1
• CVE-2026-34588OpenEXR provides the specification and reference implementat…7.8
• CVE-2026-34589OpenEXR provides the specification and reference implementat…5
• CVE-2026-3459The Drag and Drop Multiple File Upload - Contact Form 7 plug…8.1
• CVE-2026-34590Postiz is an AI social media scheduling tool. Prior to versi…5.4
• CVE-2026-34591Poetry is a dependency manager for Python. From version 1.4.…6.5