The vulnerability in BabelDOC's vendored PDF parser arises from unsafe deserialization of pickle data in the _load_data() method of babeldoc/pdfminer/cmapdb.py. The method strips only NUL bytes from a PDF-supplied CMap name, then constructs a filename and path using os.path.join(). Because os.path.join() discards preceding path components when an absolute path segment is present, an attacker can embed a hex-encoded absolute path in the PDF's /Encoding name to redirect the deserialization to any attacker-writable .pickle.gz file on the local system. The pickle data is then loaded unconditionally, enabling arbitrary Python code execution. The lack of path containment checks and absence of an allowlist or integrity verification for CMap names contribute to the exploitability of this flaw. A patch is available that enforces realpath resolution and commonpath containment checks to prevent path traversal and unauthorized file loading.

Successful exploitation allows an attacker to execute arbitrary Python code with the privileges of the BabelDOC process by causing it to deserialize attacker-controlled pickle files. This can lead to full compromise of the host system or the environment in which BabelDOC is running. The vulnerability requires the attacker to supply a crafted PDF file that triggers the unsafe deserialization during processing.

A patch is available for BabelDOC that fixes this vulnerability by resolving absolute paths and enforcing containment checks using os.path.realpath() and os.path.commonpath() to ensure that only files within trusted directories are deserialized. Users should upgrade to version 0.6.3 or later. Until patched, avoid processing untrusted PDF files with BabelDOC. There is no indication that the vulnerability is mitigated by default or that no action is required.