CVE-2026-110636
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form()…
- Risk score
- 81/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 2.7%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS com…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/revolunet/pypdftk
- https://github.com/revolunet/pypdftk/blob/1d3b40c3b42fb3cc6b0192d34aba2c21a1efd369/pypdftk.py#L87-L123
- https://github.com/revolunet/pypdftk/issues/56
- https://github.com/revolunet/pypdftk/pull/57
- https://www.vulncheck.com/advisories/pypdftk-through-0.5-os-command-injection-via-pdf-and-output-paths
- https://github.com/revolunet/pypdftk/issues/56
Original description
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
Last activity 14 Oct 2026. Patch Forecast updates every hour.