CVE-2026-77581 | alam00000 BentoPDF up to 2.8.6 CORS Proxy cors-proxy-worker.js isPrivateOrReservedHost cross-domain policy

September 24, 2026 Yanac

A vulnerability was found in alam00000 BentoPDF up to 2.8.6. It has been declared as problematic. Impacted is the function isPrivateOrReservedHost of the file cloudflare/cors-proxy-worker.js of the component CORS Proxy. Such manipulation leads to permissive cross-domain policy with untrusted domains.

This vulnerability is documented as CVE-2026-77581. The attack can be executed remotely. There is not any exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More