Description

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-21T19:17:02.720Z",
  "pubdate": "2026-08-21T19:17:02.720Z",
  "executiveSummary": "An insecure deserialization vulnerability exists in BabelDOC prior to version 0.6.3 within the vendored PDF parser located at babeldoc/pdfminer/cmapdb.py.\nThe flaw allows untrusted pickle data deserialization when CMapDB._load_data() processes CMap files.\nAn attacker can exploit this vulnerability by supplying crafted PDF documents containing manipulated Encoding or CMapName values, along with embedded PostScript usecmap operators.\nSuccessful exploitation enables arbitrary Python code execution under the security context and privileges of the BabelDOC process, leading to complete system compromise.\nThe attack vector involves path traversal techniques bypassing inadequate sanitization in _normalize_cmap_name(), which only strips a leading slash.\nThis allows directory traversal and absolute path injection via os.path.join() to target attacker-writable .pickle.gz files.\nNo specific authentication or advanced privileges are required beyond the ability to supply a malicious PDF document to the translation tool.",
  "technicalDetails": "The vulnerability resides in the CMapDB._load_data() function within the babeldoc/pdfminer/cmapdb.py file of BabelDOC's vendored PDF parser.\nThe root cause is the unsafe use of Python's pickle module via pickle.loads() to deserialize untrusted CMap data loaded from disk.\nThe attack flow begins when the application processes a malicious PDF file containing specially crafted PDF-controlled Encoding or CMapName values, accompanied by embedded PostScript usecmap operators.\nDuring parsing, path separators are decoded, and while _normalize_cmap_name() attempts to sanitize input, it merely removes a leading slash, leaving the parser vulnerable to absolute paths and directory traversal sequences.\nThese traversal sequences successfully escape the trusted CMap directories through the unsafe handling of os.path.join().\nThis mechanism allows the selection and loading of an attacker-writable .pickle.gz file from an arbitrary location.\nOnce the target pickle file is accessed, CMapDB._load_data() passes the contents directly to pickle.loads().\nThe deserialization of malicious pickle payloads triggers arbitrary Python code execution with the exact privileges of the running BabelDOC process.\nThe affected component is the CMap data loading mechanism in babeldoc/pdfminer/cmapdb.py across all BabelDOC versions prior to 0.6.3.\nThe vulnerability can be triggered locally or remotely depending on how BabelDOC ingests untrusted PDF documents, without requiring prior authentication or elevated privileges."
}