GitHub Security Advisory: GHSA-f83h-ghpp-7wcc
Package: pdfminer.six (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 20251230
Patched in: 20251230

Summary: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Details:
### 🚀 Overview

This report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.
It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.

![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)

## 🚨 Special Note

This advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).

While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808ee05dd7f0c8ea8ec34bdf394d40e63501086](https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086) does not address the vulnerability reported here.

Based on testing performed against the latest version of the library ([comparison view](https://github.com/pdfminer/pdfminer.six/compare/20250506...20251107)), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The **Dockerfile** is hence modified to run test against this claim.

This demonstrates that the patch for **CVE-2025-64512** is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle```

## 📚 Table of Contents

- [🔍 Background](#-background)
- [🐍 Vulnerability Description](#-vulnerability-description)
- [🎭 Demo Scenario](#-demo-scenario)
- [🧨 Technical Details](#-technical-details)
- [🔧 Setup and Usage](#-setup-and-usage)
- [📝 Step-by-step Walkthrough](#-step-by-step-walkthrough)
- [🛡️ Security Standards & References](#-security-standards--references)
---

## 🔍 Background

**pdfminer.six** is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module.

> 🐍 **Security Issue:**
> If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.

---

### 🐍 Vulnerability Description

- **Component:** pdfminer.six CMap loading (`pdfminer/cmapdb.py`)
- **Issue:** Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data.
- **Exploitability:** If a low-privileged user can write to any directory in `CMAP_PATH