Medium · 6.2 CVE-2025-63918 EUVD-2025-197809GHSA-h764-vg49-mhv9

PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitra…

Published Nov 17, 2025 · Updated Nov 18, 2025 · Assigned by mitre

Description

PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations.

References

https://www.cnblogs.com/pdfpatcher
https://github.com/wmjordan/PDFPatcher
https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/DirectoryTraversal-ImageExport.md