{"apiVersion":"1.0","identifier":"CVE-2026-54071","description":"BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC-s vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.","publishedAt":"2026-08-21T19:17:02","lastModifiedAt":"2026-08-21T22:16:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54071","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","epssProbability":0.00137,"riskScore":0.79,"affectedProduct":"BabelDOC","affectedVersions":"<0.6.3","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-54071","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-54071","en":"https://www.redsauce.net/en/cves/CVE-2026-54071","fr":"https://www.redsauce.net/fr/cves/CVE-2026-54071","pt":"https://www.redsauce.net/pt/cves/CVE-2026-54071","de":"https://www.redsauce.net/de/cves/CVE-2026-54071","sk":"https://www.redsauce.net/sk/cves/CVE-2026-54071","el":"https://www.redsauce.net/el/cves/CVE-2026-54071"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-54071"}}