CVE-2026-54071
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
BabelDOC before version 0.6.3 has a vendored PDF parser in babeldoc/pdfminer/cmapdb.py that deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash.
Risk Assessment
An attacker can use absolute paths or traversal sequences to select an attacker-writable .pickle.gz file and cause arbitrary Python code execution with the privileges of the BabelDOC process.
Recommendation
Upgrade BabelDOC to version 0.6.3 or later, which includes the fix.
Related vulnerabilities
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2026-120240Critical
A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-120239Critical
A vulnerability was found in WAVLINK WN553X1-B (V260403_2.0.0) in the sub_419DA8 function of /bin/ioos, within the WireGuard CLI Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been made public.
- CVE-2026-120238Critical
A vulnerability has been found in WAVLINK WN553X1-B (260403_2.0.0) in the sub_4162A8 function of /bin/ioos, within the ovpn_file Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be executed remotely and the exploit has been disclosed to the public.
- CVE-2026-62048Critical
The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.
- CVE-2026-120338Critical
The Generative UI sandbox in prefab-ui runs caller-supplied Python inside Pyodide (WebAssembly) in a Deno subprocess, but from 0.14.0 through 0.20.2 Deno starts with unrestricted --allow-read, --allow-write, and --allow-net, and the Deno API remains on the JavaScript global object. This lets Python call Deno.readTextFileSync and Deno.writeTextFileSync, enabling file read/write as the server OS user and persistent code execution via a .pth file in site-packages.
- CVE-2026-120231Critical
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0 in the function sub_416568 of /bin/ioos, part of the OpenVPN CLI Handler. Manipulating the file_id argument leads to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-120230Critical
A vulnerability was found in WAVLINK WN701AE 260105 in the function del_vlan_group of the ioos Web Backend. Manipulating the vlan_name argument results in OS command injection. The attack may be performed remotely and the exploit has been made public.
- CVE-2026-120229Critical
A vulnerability was found in WAVLINK WN553X1-B version 260403_2.0.0 affecting the sub_416B50 function in /bin/ioos. Manipulation of the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS