PDFPatcher versions through 1.1.3.4663 have a vulnerability in their XML bookmark import functionality due to improper handling of XML external entity (XXE) references. This allows attackers to read arbitrary files, exfiltrate data via out-of-band HTTP requests, perform SSRF attacks, or cause denial of service through entity expansion. The vulnerability arises because the application uses .NET's XmlDocument class without disabling external entity resolution.