CVE-2026-54071

Name of the Vulnerable Software and Affected Versions BabelDOC versions prior to 0.6.3

Description BabelDOC contains a flaw in its vendored PDF parser where the CMapDB. load data() function deserializes untrusted pickle data when loading CMap files. An attacker can use hex-encoded absolute paths or traversal sequences in a crafted PDF's /Encoding or CMapName values, or via embedded PostScript usecmap operators, to bypass trusted directories. By redirecting the process to an attacker-writable .pickle.gz file on the local system, the attacker can achieve arbitrary Python code execution with the privileges of the BabelDOC process. This is possible because the normalize cmap name() function only removes a leading slash and the load data() function fails to perform proper path canonicalization or containment checks before calling pickle.loads().

Recommendations Update to version 0.6.3. As a temporary mitigation, do not set the CMAP PATH environment variable. Run the software under an account that lacks permissions to create files in directories accessed for CMap data. Avoid processing PDF files from untrusted sources.