CVE-2026-54071
Received Received - Intake

Path Traversal in BabelDOC PDF Parser

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54071
EUVD
EUVD-2026-64058

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
funstory-ai babeldoc to 0.6.3 (exc)
funstory-ai babeldoc 0.6.3
babeldoc babeldoc to 0.6.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54071 is an arbitrary code execution vulnerability in BabelDOC versions 0.6.2 and earlier. It occurs in the pdfminer/cmapdb.py file where unsafe deserialization of untrusted pickle data happens when loading CMap files. Attackers can exploit this by crafting PDFs with malicious paths in CMap names, leading to arbitrary Python code execution with the privileges of the BabelDOC process.

Detection Guidance

To detect this vulnerability, check if BabelDOC versions 0.6.2 or earlier are installed. Run: pip show babeldoc or pip list | grep babeldoc. If installed, verify if the system processes untrusted PDFs with BabelDOC. Monitor for unexpected code execution or system changes during PDF processing.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on systems running vulnerable BabelDOC versions. It can lead to full system compromise, data breaches, data modification, denial of service, and privilege escalation. Any user or automated pipeline processing untrusted PDFs with BabelDOC is at risk, even without elevated privileges.

Compliance Impact

This vulnerability can lead to confidentiality breaches and data modification, which directly violate GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations processing sensitive data with vulnerable BabelDOC versions risk non-compliance, potential fines, and reputational damage.

Mitigation Strategies

Upgrade BabelDOC to version 0.6.3 or later immediately. Remove or restrict access to untrusted PDFs until patched. If upgrading is not possible, disable PDF processing features or isolate BabelDOC in a sandboxed environment to limit potential damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart