CVE-2026-110636
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pd…
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
- Vendor
- Unknown
- Product
- Unknown
- CVSS 3.1
- 9.8 (critical), scored by disclosure@vulncheck.com (primary)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 4.0
- 9.3 (critical), scored by disclosure@vulncheck.comCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE
- CWE-78
- Published
- 2026-10-14
- NVD modified
- 2026-10-14
- NVD status
- Received
Not in the CISA KEV catalogue at the last update.
References
Data last updated 15 Oct 2026. Sources: NVD API 2.0. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.