CVE-2023-50165: High Generated PDF Flaw in Pega Platform

CVE-2023-50165 is a high severity (CVSS 8.5) flaw in Pega Platform versions 8.2.1 through Infinity 23.1.0. The vendor describes it as a generated PDF issue that could expose file contents. Pega published a hotfix for each affected release, and no restart is needed. Apply the one for your version.

What's affected

• Pega Platform 8.2.1 to Infinity 23.1.0, per the NVD description.
• Fixed by hotfix, one per release. The vendor remediation note lists, for example, HFIX-A1436 for 8.2.1, HFIX-A1400 for 8.4.1, HFIX-A1361 for 8.6.0, HFIX-A1347 for 8.8.0 and HFIX-A1343 for 23.1.0. The full table is in the vendor note and some content needs a Pega login.
• The vendor says the hotfixes need no restart after installation.
• The record classifies the weakness as CWE-918, server side request forgery. The vendor note describes it only as a generated PDF issue that could expose file contents, so the two descriptions do not match in detail.
• KEV status: the record shows kev as false.

How to check if you're exposed

Find your Pega Platform version in the Designer Studio or Dev Studio about page, or ask your platform team. Then match it to the hotfix table in the Pega remediation note. If your version appears in the table, check whether the matching hotfix is installed.

Hotfix status is tracked inside Pega, in the hotfix manager of the platform. We did not find a command line check, so follow the vendor note and your Pega support contact for the exact verification steps.

What to do now

1. Identify every Pega environment, including development and test, and record the platform version of each.
2. Install the hotfix that matches each version from the vendor remediation note.
3. Plan an upgrade to a current release. The vendor says staying current is the best practice for security fixes.
4. Review which users can trigger PDF generation and what content those PDFs can pull in.
5. Check logs for unexpected PDF generation activity around the time you were unpatched.

Why it matters

Server side features that render documents often fetch resources on behalf of the user. If the renderer accepts a path or URL that points to something the user should not reach, the generated file can carry content from the server back to the requester. That is the general shape of CWE-918. The vendor wording, file contents being exposed, fits that pattern, but the advisory does not give the exact mechanism and we will not guess it.

The network vector and the high confidentiality impact explain the score. Pega Platform often sits at the center of case management and customer workflows, so a read exposure there can touch sensitive records and configuration files.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2023-50165
• Pega security advisory G23 remediation note

Last reviewed: 19 October 2026.