CVE-2026-110636 Details
Description
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
A command injection vulnerability has been identified in the pypdftk library, specifically in versions through 0.5. The issue arises in the functions fill_form(), dump_data_fields(), and pdftk_cmd_util(), where user-supplied paths are used to build shell commands. This flaw allows attackers to inject shell metacharacters that are executed as operating system commands by the Python process.
Users are advised to update to the latest version of pypdftk, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/revolunet/pypdftk/issues/56 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/revolunet/pypdftk | [email protected] | Vendor |
| https://github.com/revolunet/pypdftk/blob/1d3b40c3b42fb3cc6b0192d34aba2c21a1efd369/pypdftk.py#L87-L123 | [email protected] | Source CodeVendor |
| https://github.com/revolunet/pypdftk/issues/56 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/revolunet/pypdftk/pull/57 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/pypdftk-through-0.5-os-command-injection-via-pdf-and-output-paths | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pypdftk | <= 0.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |