Remote Code Execution Vulnerability in BabelDOC Document Translation Tool

CVE-2026-54071

What is CVE-2026-54071?

BabelDOC, a document translation tool, contains a vulnerability that allows an attacker to execute arbitrary code by deserializing untrusted data from CMap files. This occurs due to improper handling of path separators, enabling traversal sequences to escape trusted directories. As a result, an attacker can select a writable .pickle.gz file, leading to the execution of malicious Python code within the context of the BabelDOC process. The issue has been addressed in version 0.6.3.

References