CVE-2026-110636

Name of the Vulnerable Software and Affected Versions pypdftk versions prior to 0.6

Description An OS command injection issue exists in the fill form(), dump data fields(), and pdftk cmd util() functions. The software constructs shell commands using paths provided by the caller. An attacker who can control the pdf path or out file variables can inject shell metacharacters. These characters are interpreted by subprocess.Popen when shell=True is used, allowing the execution of arbitrary OS commands with the privileges of the Python process.

Recommendations Update pypdftk to a version newer than 0.5. As a temporary mitigation, restrict user control over the pdf path and out file variables used in the fill form(), dump data fields(), and pdftk cmd util() functions.