CVE-2025-70559

🚀 Overview

This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.

🚨 Special Note

This advisory addresses a distinct vulnerability from GHSA-wf5f-4jwr-ppcp (CVE-2025-64512).

While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 does not address the vulnerability reported here.

Based on testing performed against the latest version of the library (comparison view), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The Dockerfile is hence modified to run test against this claim.

This demonstrates that the patch for CVE-2025-64512 is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on pickle

📚 Table of Contents

• 🔍 Background
• 🐍 Vulnerability Description
• 🎭 Demo Scenario
• 🧨 Technical Details
• 🔧 Setup and Usage
• 📝 Step-by-step Walkthrough
• 🛡️ Security Standards & References

🔍 Background

pdfminer.six is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's pickle module.

🐍 Security Issue: If the CMap search path (CMAP_PATH or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious .pickle.gz file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.

🐍 Vulnerability Description

• Component: pdfminer.six CMap loading (pdfminer/cmapdb.py)
• Issue: Loads and deserializes .pickle.gz files using Python’s pickle module, which is unsafe for untrusted data.
• Exploitability: If a low-privileged user can write to any directory in CMAP_PATH, they can execute code as the user running pdfminer—potentially root or a privileged service.
• Impact: Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.

🎭 Demo Scenario

Environment:

• 🐧 Alpine Linux (Docker container)
• 👨‍💻 Two users:
  • user1 (attacker: low-privilege)
  • root (victim: runs privileged PDF-processing script)
• 🗂️ Shared writable directory: /tmp/uploads
• 🛣️ CMAP_PATH set to /tmp/uploads for the privileged script
• 📦 pdfminer.six installed system-wide

Attack Flow:

1. 🕵️‍♂️ user1 creates a malicious CMap file (Evil.pickle.gz) in /tmp/uploads.
2. 👑 The privileged service (root) processes a PDF or calls get_cmap("Evil").
3. 💣 The malicious pickle is…

PDF parser and analyzer.

Security Fix(es):

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.(CVE-2025-70559)

PDF parser and analyzer.

Security Fix(es):

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.(CVE-2025-70559)

🚀 Overview

This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.

🚨 Special Note

This advisory addresses a distinct vulnerability from GHSA-wf5f-4jwr-ppcp (CVE-2025-64512).

While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 does not address the vulnerability reported here.

Based on testing performed against the latest version of the library (comparison view), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The Dockerfile is hence modified to run test against this claim.

This demonstrates that the patch for CVE-2025-64512 is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on pickle

📚 Table of Contents

• 🔍 Background
• 🐍 Vulnerability Description
• 🎭 Demo Scenario
• 🧨 Technical Details
• 🔧 Setup and Usage
• 📝 Step-by-step Walkthrough
• 🛡️ Security Standards & References

🔍 Background

pdfminer.six is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's pickle module.

🐍 Security Issue: If the CMap search path (CMAP_PATH or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious .pickle.gz file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.

🐍 Vulnerability Description

• Component: pdfminer.six CMap loading (pdfminer/cmapdb.py)
• Issue: Loads and deserializes .pickle.gz files using Python’s pickle module, which is unsafe for untrusted data.
• Exploitability: If a low-privileged user can write to any directory in CMAP_PATH, they can execute code as the user running pdfminer—potentially root or a privileged service.
• Impact: Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.

🎭 Demo Scenario

Environment:

• 🐧 Alpine Linux (Docker container)
• 👨‍💻 Two users:
  • user1 (attacker: low-privilege)
  • root (victim: runs privileged PDF-processing script)
• 🗂️ Shared writable directory: /tmp/uploads
• 🛣️ CMAP_PATH set to /tmp/uploads for the privileged script
• 📦 pdfminer.six installed system-wide

Attack Flow:

1. 🕵️‍♂️ user1 creates a malicious CMap file (Evil.pickle.gz) in /tmp/uploads.
2. 👑 The privileged service (root) processes a PDF or calls get_cmap("Evil").
3. 💣 The malicious pickle is…

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. (CVE-2025-64512, CVE-2025-70559)