During a recent pentest, we exploited an insecure PDF generator to trigger SSRF and access AWS instance metadata. PDF generators often allow risky features like JavaScript by default, making them an overlooked attack surface.