A critical arbitrary file upload vulnerability has been discovered in the AddFont() function of FPDF library version 1.86 and earlier. The vulnerability allows attackers to execute arbitrary code by uploading a specially crafted PHP file through the affected function. This represents a significant security risk as it provides a direct path for remote code execution. All versions up to and including v1.86 are affected by this vulnerability. Organizations using FPDF library should update to a patched version or implement appropriate security controls.