wmjordan/PDFPatcher

wmjordan/PDFPatcher

pdfpatcher.cnblogs.com

Releases11

Frequency3 months 2 weeks

Last Release 10 months ago

Stars12.5K

PDF补丁丁——PDF工具箱，可以编辑书签、剪裁旋转页面、解除限制、提取或合并文档，探查文档结构，提取图片、转成图片等等

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-63917 ↗	Nov 17, 2025Monday, 17 November 2025, 17:15	7.1 HIGH	—
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks.
CVE-2025-63918 ↗	Nov 17, 2025Monday, 17 November 2025, 17:15	6.2 MEDIUM	—
PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations.