PT-2026-5984 · Pypi · Pdfminer.Six
Published
2025-11-07
·
Updated
2026-02-11
·
CVE-2025-70559
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
pdfminer.six versions prior to 20251230
Description
pdfminer.six contains an insecure deserialization issue in the CMap loading mechanism. The library utilizes Python pickle to deserialize CMap cache files without proper validation. An attacker who can place a malicious pickle file in a location accessible to the application can potentially execute arbitrary code or escalate privileges when the file is loaded by a trusted process. This is due to an incomplete fix for a previously reported issue. A proof-of-concept demonstrates that a low-privileged user can gain root access in a multi-user or server environment by exploiting this insecure deserialization. The vulnerable code is located in the
pdfminer/cmapdb.py file, specifically in the load data method, where pickle.loads() is used without validation. The vulnerable line of code is: return type(str(name), (), pickle.loads(gzfile.read())). The exploit involves creating a malicious pickle file and placing it in a directory included in the CMAP PATH environment variable. When a privileged process loads a CMap, the malicious pickle is deserialized, leading to code execution with the privileges of that process.Recommendations
versions prior to 20251230: Update pdfminer.six to version 20251230 or later.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pdfminer.Six