EXPOSURES › CVE-2026-110636
CVE-2026-110636
CRITICALpypdftk through 0.5 allows OS command injection via fill_form(), dump_data_fields(), and pdftk_cmd_util() when processing user-supplied PDF paths.
An attacker controlling pdf_path or out_file can inject shell metacharacters that execute arbitrary OS commands as the Python process. This is a critical RCE vulnerability that enables remote code execution if the application processes untrusted PDF paths, directly impacting DIB compliance by allowing attackers to bypass security controls and execute malicious payloads.
Shame score — The vulnerability allows arbitrary OS command execution via user-supplied paths, representing a severe avoidable failure in input validation and subprocess handling.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.