{"id":"CVE-2026-54071","title":"BabelDOC is a document translation tool","summary":"BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName valu…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"BabelDOC","product":"BabelDOC","affected":["BabelDOC <= 0.6.2"],"patched":["BabelDOC 0.6.3"],"published":"2026-08-21","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:10:00.297","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54071","references":[{"url":"https://github.com/funstory-ai/BabelDOC/blob/main/docs/release-notes/v0.6.3.md","label":"security-advisories@github.com"},{"url":"https://github.com/funstory-ai/BabelDOC/commit/28f784ca6b437dbba040bfd9c67110373cd0924b","label":"security-advisories@github.com"},{"url":"https://github.com/funstory-ai/BabelDOC/releases/tag/v0.6.3","label":"security-advisories@github.com"},{"url":"https://github.com/funstory-ai/BabelDOC/security/advisories/GHSA-m8gf-v64p-gfmg","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-m8gf-v64p-gfmg"}],"tags":["nvd","ghsa","pip"],"epss":0.0038,"epssPercentile":0.31786,"aliases":["GHSA-m8gf-v64p-gfmg"],"ecosystem":"pip","ingestedAt":"2026-07-10T20:06:10.734Z","slug":"CVE-2026-54071","body":"## Overview\n\nBabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54071)\n\nAffected packages:\n\n- `BabelDOC <= 0.6.2`\n\nPatched in:\n\n- `BabelDOC 0.6.3`\n\nSource: https://github.com/advisories/GHSA-m8gf-v64p-gfmg","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}