CVE-2026-110636 is a critical OS command injection flaw (CVSS 9.8) in the pypdftk Python library through version 0.5. An attacker who controls the PDF path or output path can run arbitrary commands as the Python process.
What Is It
pypdftk is a Python wrapper for pdftk, maintained by revolunet and distributed on PyPI. According to the VulnCheck disclosure, three functions build shell commands from paths supplied by the caller: fill_form(), dump_data_fields() and pdftk_cmd_util(). Those commands are run through subprocess.Popen with shell=True. If an attacker controls pdf_path or out_file, they can add shell metacharacters that the shell will interpret. The result is OS command execution with the privileges of the Python process.
The weakness is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
Why It Matters
VulnCheck scores the flaw as critical on both CVSS scales:
- CVSS 3.1: 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3
Both vectors describe a network-reachable attack with low complexity, no privileges required and no user interaction, and a high impact on confidentiality, integrity and availability. In practice the risk applies to applications that pass user-influenced file paths into pypdftk. Web services that fill PDF forms or extract form fields are typical examples.
Exploitation status: CVE-2026-110636 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation in the wild at this time. The NVD record is in "Received" status and has not yet been analyzed by NVD.
What's Vulnerable
- Vendor: revolunet
- Product: pypdftk (
pkg:pypi/pypdftk) - Affected versions: all versions through 0.5 (0 ≤ version ≤ 0.5)
- Affected functions:
fill_form(),dump_data_fields(),pdftk_cmd_util() - Attacker-controlled inputs:
pdf_path,out_file
The vulnerable code is at lines 87–123 of pypdftk.py at commit 1d3b40c.
Patch Status
The supplied records do not identify a fixed release. The references include a GitHub issue (#56) and a pull request (#57) in the pypdftk repository, but the source data does not say whether the pull request has been merged or released. Because the CVE is not in the KEV catalog, no CISA required action or due date applies.
Until a fixed version is confirmed, organizations using pypdftk 0.5 or earlier should:
- find every code path where untrusted input can reach pdf_path or out_file
- follow the upstream issue and pull request for remediation status