The vulnerability exists in BabelDOC's vendored PDF parser (babeldoc/pdfminer/cmapdb.py) in the _load_data() method, which deserializes pickle data from CMap files. The method strips only NUL bytes from a PDF-controlled CMap name and constructs a filename that is joined with trusted directories using os.path.join(). However, if the CMap name is an absolute path (achieved via PDF hex-encoding), os.path.join() discards the trusted directory and uses the absolute path directly. This allows an attacker to redirect deserialization to any attacker-writable .pickle.gz file on the local system. Since pickle.loads() is called unconditionally on this file, arbitrary Python code execution can occur. There is no path containment check or allowlist of CMap names, and no integrity verification of the pickle data. The vulnerability is identified as CWE-502 (Deserialization of Untrusted Data).

Successful exploitation allows an attacker to execute arbitrary Python code with the privileges of the BabelDOC process by controlling the deserialized pickle data. This can lead to full compromise of the host system or further attacks depending on the environment and privileges of BabelDOC.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended patch involves validating that the resolved file path is contained within trusted directories by using os.path.realpath() and os.path.commonpath() before deserializing pickle data. Until a patch is applied, avoid processing untrusted PDFs with BabelDOC or run BabelDOC with minimal privileges and in isolated environments to limit impact.