CVE-2025-63918

Medium · 6.2

CVSS

6.2

EPSS

0.4%

Published

Nov 17, 2025

CISA due date

—

The record

PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations.

Affected packages

Ecosystem	Package	Introduced	Fixed