Arbitrary File Write

2023-07-2701:20:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pandoc

arbitrary file write

pdf

extract-media

vulnerability

user input

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:L

EPSS

0.001

Percentile

47.5%

JSON

pandoc is vulnerable to Arbitrary File Write. By providing a constructed picture element as input while creating files with the --extract-media option or outputting to PDF format, an arbitrary file write vulnerability may be exploited. This vulnerability affects systems that enable pandoc to output a PDF or utilize the --extract-media option with untrusted user input.