ETK-2026-1284Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1284",
  "cve_id": null,
  "display_id": "ETK-2026-1284",
  "ghsa_id": "GHSA-ppm7-rg95-2c2p",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Plaintext disclosure during PDF encryption in pdfcpu",
  "summary": "pdfcpu versions before 0.16.2 can leave strings from compressed objects readable in PDFs that appear encrypted. An attacker able to obtain such an output file may read exposed content without the PDF password when the input contains object streams.",
  "mitigation": "Upgrade pdfcpu to version 0.16.2 or later. Review PDFs encrypted with affected versions for sensitive plaintext and regenerate them from trusted source files after upgrading.",
  "vendor": "go",
  "product": "go:github.com/pdfcpu/pdfcpu",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.8.0, < 0.16.2"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "0.16.2"
      ],
      "package_name": "github.com/pdfcpu/pdfcpu",
      "purl": "pkg:golang/github.com/pdfcpu/pdfcpu"
    }
  ],
  "cwes": [
    311
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.09673345,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-11T22:52:29+00:00",
      "days": -9.249273120532408,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:26.219671+00:00",
      "url": "https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-ppm7-rg95-2c2p"
    }
  }
}