CVE-2026-110636

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110636

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

EUVD-2026-101264

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110636

The pypdftk library (through version 0.5 ) is vulnerable to OS command injection within the fill_form(), dump_data_fields(), and pdftk_cmd_util() functions. The root cause is the construction of shell commands using caller-supplied paths for pdf_path or out_file without proper sanitization. Becau...

CVE-2026-110636: Improper Neutralization of Special Elements used in an OS Command

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

PT-2026-114078

Name of the Vulnerable Software and Affected Versions pypdftk versions prior to 0.6 Description An OS command injection issue exists in the fill form, dump data fields, and pdftk cmd util functions. The software constructs shell commands using paths provided by the caller. An attacker who can...