CVE-2026-54071

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Published Aug 21, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.

Analysis

Technical impact

BabelDOC, a document translation tool, contains an untrusted pickle deserialization flaw in its bundled PDF parser. The flaw is triggered when the CMapDB module loads CMap files without properly validating the path name. An attacker can craft a PDF that includes a specially crafted CMap or usecmap operator which, once decoded, points to an attacker-controlled .pickle.gz file placed in the CMap directories. The pickle loader will then execute arbitrary Python code with the permissions of the running BabelDOC process, allowing full system compromise in that environment. The issue is fixed in version 0.6.3, and the vulnerability is now contained to older releases.

Affected Systems

The vulnerability affects funstory-ai’s BabelDOC product. Any installation of BabelDOC older than version 0.6.3 is susceptible, as the code path that deserializes external pickle data remains unpatched in those releases.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity level. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no widespread active exploitation has been reported yet. The likely attack vector is via a malicious PDF processed by BabelDOC, which can be delivered locally or potentially over a network if BabelDOC is exposed to external PDF uploads.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

funstory-ai

BabelDOC

affected

Version	Status	Constraints
`< 0.6.3`	affected	—

No data.

Vendor Product Versions

Funstory-ai

Babeldoc

Version	Status	Scheme	Platform
`[0,0.6.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade BabelDOC to version 0.6.3 or newer, which removes the vulnerable pickle deserialization logic.
Run the BabelDOC process with the least privileges necessary and restrict file system access to the CMap directories so that even if a malicious pickle is loaded, it cannot be written to writable locations that could be leveraged by the attacker.
Ensure that only trusted PDFs are processed by BabelDOC; if possible, pre-sanitize or validate incoming PDFs to disallow usecmap operations or to reject any documents that reference external CMap files.

Generated by OpenCVE AI on August 21, 2026 at 20:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-m8gf-v64p-gfmg	BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.380% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/funstory-ai/BabelDOC/blob/main/docs/release-notes/v0.6.3.md
https://github.com/funstory-ai/BabelDOC/commit/28f784ca6b437dbba040bfd9c67110373cd0924b
https://github.com/funstory-ai/BabelDOC/releases/tag/v0.6.3
https://github.com/funstory-ai/BabelDOC/security/advisories/GHSA-m8gf-v64p-gfmg

History

Aug 21, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Funstory-ai Funstory-ai babeldoc
Vendors & Products		Funstory-ai Funstory-ai babeldoc

Aug 21, 2026 7:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.
Title		BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
Weaknesses		CWE-502
References		https://github.com/funstory-ai/BabelDOC/blob/main/docs/release-notes/v0.6.3.md https://github.com/funstory-ai/BabelDOC/commit/28f784ca6b437dbba040bfd9c67110373cd0924b https://github.com/funstory-ai/BabelDOC/releases/tag/v0.6.3 https://github.com/funstory-ai/BabelDOC/security/advisories/GHSA-m8gf-v64p-gfmg
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`