CVE-2026-110636

Deferred Deferred - Pending Action

OS Command Injection in pypdftk Library

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110636

EUVD

EUVD-2026-101264

Affected Vendors & Products

Vendor	Product	Version / Range
revolunet	pypdftk	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in the pypdftk library version 0.5. Attackers can inject shell metacharacters into file paths like pdf_path or out_file. When these paths are passed to functions like fill_form() with shell=True, the shell interprets metacharacters and executes arbitrary OS commands as the Python process.

Detection Guidance

Check if pypdftk version 0.5 or earlier is installed using pip list | grep pypdftk. Review Python applications using pypdftk for unsanitized user-controlled inputs passed to functions like fill_form(), dump_data_fields(), or pdftk_cmd_util().

Inspect code for subprocess.Popen calls with shell=True and direct string interpolation of user inputs. Monitor for unexpected system commands or file creations in logs.

Impact Analysis

An attacker could execute arbitrary commands on your system, leading to full compromise, data theft, or denial of service. Since the vulnerability affects functions handling PDF paths, any application using pypdftk to process untrusted PDFs is at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected software may face compliance violations and legal penalties.

Mitigation Strategies

Upgrade pypdftk to a patched version or apply the fix from pull request #57 to replace shell=True with list-based subprocess calls. Validate all user-controlled inputs to ensure they are safe file paths.

If upgrading is not possible, disable affected functions or replace pypdftk with an alternative library. Audit all code paths using pypdftk for potential injection vectors.

Hi! I’m here to help you understand CVE-2026-110636. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70