CVE-2026-34586 mrmn2 CVE debrief

Who should care

Users of PdfDing version prior to 1.7.1 should apply the patch to prevent unauthorized access to shared PDF content. System administrators and security teams responsible for managing PDFDing deployments should review and update access controls, monitor for suspicious activity, and ensure that PDFDing is upgraded to version 1.7.1 or later.

Technical summary

The check_shared_access_allowed() function in PdfDing validates only session existence but does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1. Users should review and update access controls for shared PDF content.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch by upgrading to PdfDing version 1.7.1 or later
• Review and update access controls for shared PDF content
• Monitor for suspicious activity related to shared PDF access
• Verify PDFDing version and patch status
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record was published on 2026-03-31T21:16:31.123Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify PDFDing version and patch status, review access controls, and monitor for suspicious activity.

Official resources