html2pdf

CRITICAL VULNERABILITIES: The server allows path traversal for both input HTML files (`htmlPath`) and output PDF files (`outputPath`). A malicious actor can provide arbitrary file paths, potentially leading to unauthorized reading of sensitive local files via `file://` URLs (`fs.access` only checks existence, not content/permissions for sensitive files) and writing PDFs to arbitrary locations on the server's filesystem, which could overwrite critical system files or exhaust disk space. The `htmlContent`, `headerTemplate`, and `footerTemplate` parameters also accept raw HTML, which could embed malicious JavaScript if the generated PDF is viewed in an insecure context, though the immediate impact is contained within the PDF. Running Puppeteer with `--no-sandbox` (common in Docker) further reduces isolation, making these path traversal vulnerabilities more critical if the server is run as root or with elevated privileges.