PT-2026-57365 · Babeldoc · Babeldoc
Published
2026-07-10
·
Updated
2026-07-10
·
CVE-2026-54071
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BabelDOC versions prior to 0.6.3
Description
BabelDOC contains a flaw that allows arbitrary Python code execution when processing a specially crafted PDF file. The issue exists in the vendored PDF parser within the
CMapDB. load data() function, which deserializes untrusted data using the pickle.loads() function. An attacker can use hex-encoding in a PDF's /Encoding name to inject an absolute path, bypassing intended directory restrictions via Python's os.path.join() behavior. This allows the application to load and execute a malicious .pickle.gz file previously placed on the local filesystem by the attacker. The vulnerability can also be triggered via the PostScript usecmap operator using relative path traversal.Recommendations
Update BabelDOC to version 0.6.3 or later.
As a temporary mitigation, do not set the
CMAP PATH environment variable.
Run the software under a user account that lacks permissions to create files in directories where CMap data is read.
Avoid processing PDF files from untrusted sources.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Babeldoc