Advisories for Composer/Tecnickcom/Tcpdf package

Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through src tag, potentially exposing sensitive information.

TCPDF version <=6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

TCPDF before 6.7.4 mishandles calls that use HTML syntax.

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.