PT-2025-47167 · Unknown · Pdfpatcher

Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-63917

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions PDFPatcher versions through 1.1.3.4663

Description The software does not properly restrict XML external entity (XXE) references in its XML bookmark import functionality. The application utilizes .NET’s XmlDocument class without disabling external entity resolution, which could allow attackers to read arbitrary files from the victim’s filesystem, exfiltrate sensitive data through out-of-band (OOB) HTTP requests, perform server-side request forgery (SSRF) attacks against internal network resources, or cause a denial of service via entity expansion attacks.

Recommendations Versions prior to 1.1.3.4663 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-63917

Affected Products

Pdfpatcher

References · 8

• 🔥 https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/XXE-Importers.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-63917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63917 · Security Note
• https://github.com/wmjordan/PDFPatcher · Note
• https://cnblogs.com/pdfpatcher · Note
• https://twitter.com/VulmonFeeds/status/1990531476425752670 · Twitter Post
• https://twitter.com/CVEnew/status/1990462693153652898 · Twitter Post
• https://t.me/CVEtracker/37518 · Telegram Post