varlib-cve-2025-66034

fontTools varLib CVE-2025-66034 漏洞利用 此仓库并未引入新的漏洞。 这是一个针对 CVE-2025-66034 的概念验证（PoC）漏洞利用工具，影响 fontTools 的 varLib 可变字体生成流程。 该漏洞允许攻击者在精心构造的 .designspace 文件中控制输出文件名。当该文件被存在漏洞的字体生成服务处理时，可能导致在服务器文件系统上任意写入文件。 脚本 varlibcve202566034.py 可自动化载荷创建、字体生成、上传以及可选的 Shell 触发。 功能特性 使用 fontTools 自动创建兼容的主字体 随机化 Shell...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib मनमाना फ़ाइल लेखन भेद्यता fontTools एक Python लाइब्रेरी है जो फ़ॉन्ट फ़ाइलों में हेरफेर करने के लिए है। इसका varLib मॉड्यूल .designspace फ़ाइलों को प्रोसेस करता है — यह एक XML प्रारूप है जो बताता है कि एक वेरिएबल फ़ॉन्ट उत्पन्न करने के लिए कई फ़ॉन्ट मास्टर्स को...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib Scrittura Arbitraria di File → RCE PoC exploit per una vulnerabilità di Scrittura Arbitraria di File + Iniezione XML infontTools.varLib Testato su HackTheBox — VarIaType Vulnerabilità fontTools.varLib elabora file XML .designspace per creare font variabili. Due...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Scrittura Arbitraria di File + Iniezione XML → Esecuzione Remota di Codice Indice Panoramica Dettagli della vulnerabilità Catena di attacco Requisiti Installazione Configurazione Utilizzo Come funziona Codice vulnerabile Checklist pre-sfruttamento...

PYSEC-2026-1389 fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Summary The fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main code path of fontTools.varLib, used by the fonttools varLib CLI and...

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

CVE-2025-66034 — fontTools varLib Arbitrary File Write → RCE...

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

fontvarlib.py — CVE-2025-66034 fontTools varLib — Arbi...

Arbitrary File Write

fontTools is vulnerable to an arbitrary file write. The vulnerability is due to improper handling of malicious .designspace files in the fontTools.varLib module, which allows an attacker to achieve remote code execution by writing arbitrary files when processed...

CVE-2025-66034

This vulnerability in fontTools varLib allows a crafted .designspace file to trigger arbitrary file writes and XML-based content injection during variable-font generation. Because filenames are not sanitized, an attacker can use path traversal to overwrite files anywhere on the filesystem, and...

SUSE CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Summary The fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main code path of fontTools.varLib, used by the fonttools varLib CLI and...

GHSA-768J-98CG-P3FV fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Summary The fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main code path of fontTools.varLib, used by the fonttools varLib CLI and...

CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

DEBIAN-CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

UBUNTU-CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

CVE-2025-66034 fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

CVE-2025-66034 fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

CVE-2025-66034 fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib or python3 -m fontTools.varLib script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The...

CVE-2025-66034

CVE-2025-66034 affects fontTools, a Python font manipulation library. Affected: fontTools.varLib main() path when processing malicious .designspace files; arbitrary file write can lead to remote code execution. Impact: high (per CVSS 3.1, base 9.8) when exploited via the varLib CLI or code invoki...