CVE-2026-110636 in pypdftk
Summary
by MITRE • 10/15/2026
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in pypdftk versions through 0.5 represents a critical security flaw rooted in improper neutralization of special elements used in an operating system command, commonly classified under CWE-78. This weakness manifests specifically within three core functions: fill_form(), dump_data_fields(), and pdftk_cmd_util(). These components are responsible for constructing shell commands by integrating user-supplied input directly into the execution string without adequate sanitization or validation. The root cause lies in the use of subprocess.Popen with the shell parameter set to True, which instructs Python to execute the command via a system shell such as /bin/sh on Unix-like systems or cmd.exe on Windows. When combined with unsanitized inputs for parameters like pdf_path and out_file, this configuration allows an attacker to inject arbitrary shell metacharacters that are interpreted by the underlying operating system rather than treated as literal file path components.
From a technical perspective, the exploitation of this vulnerability relies on the ability of an attacker to control either the source PDF document path or the output file destination. By injecting characters such as semicolons, pipes, ampersands, or backticks into these parameters, an adversary can break out of the intended command context and append additional commands for execution. For instance, if a user provides a filename like report.pdf; rm -rf /tmp/data, the shell will execute pdftk with the first argument as intended but then proceed to run the subsequent destructive command. This behavior is consistent with attack patterns documented in the MITRE ATT&CK framework under T1059, specifically Command and Scripting Interpreter, where attackers leverage native system tools to achieve arbitrary code execution. The severity of this issue is heightened because it allows for remote or local privilege escalation depending on the permissions of the Python process running pypdftk, potentially leading to complete compromise of the host system if executed with elevated privileges.
The operational impact of this vulnerability extends beyond simple command injection. It enables unauthorized data exfiltration by allowing attackers to redirect output files to accessible locations for later retrieval or to execute commands that read sensitive configuration files and transmit them externally. Furthermore, it can facilitate denial-of-service conditions through resource exhaustion attacks initiated via the injected shell commands. In environments where pypdftk is used within web applications or automated processing pipelines, this flaw could be exploited remotely if user-controlled file paths are passed directly to these functions without prior validation. This creates a significant risk vector for organizations relying on PDF manipulation tools that do not implement strict input filtering mechanisms before passing data to system-level commands.
To mitigate this vulnerability, developers must immediately upgrade pypdftk to version 0.6 or later where the issue has been addressed by removing reliance on shell=True and implementing safer subprocess execution methods such as using a list of arguments passed directly to Popen without invoking an intermediate shell. If upgrading is not feasible in the short term, immediate remediation requires rigorous input validation for all file path parameters before they are used in command construction. This includes enforcing strict allowlists that restrict characters allowed in filenames and paths, ensuring that only alphanumeric characters, hyphens, underscores, dots, and forward slashes or backslashes as appropriate for the operating system are permitted. Additionally, implementing chroot jails or containerization can limit the blast radius of any successful exploitation by restricting the file system access available to the Python process. Regular security audits focusing on dynamic command execution patterns in third-party libraries are essential to prevent similar injection flaws from persisting in software supply chains.