CVE-2025-63917
📋 TL;DR
PDFPatcher versions up to 1.1.3.4663 contain an XML External Entity (XXE) vulnerability in the XML bookmark import functionality. Attackers can exploit this to read arbitrary files from the victim's filesystem, exfiltrate sensitive data via HTTP requests, perform SSRF attacks, or cause denial of service. Users of PDFPatcher who import XML bookmarks are affected.
💻 Affected Systems
- PDFPatcher
📦 What is this software?
Pdfpatcher by Cnblogs
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive files including credentials, configuration files, and personal data; SSRF attacks against internal services; system instability via DoS.
Likely Case
Exfiltration of local files containing sensitive information when users import malicious XML bookmarks.
If Mitigated
Limited impact if XML bookmark import is disabled or external network access is restricted.
🎯 Exploit Status
Exploitation requires user to import a malicious XML file; proof-of-concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor GitHub repository for updates: https://github.com/wmjordan/PDFPatcher
🔧 Temporary Workarounds
Disable XML bookmark import
allPrevent use of the vulnerable XML bookmark import functionality.
Use XML parser with secure settings
allModify source code to use XmlDocument with XmlResolver set to null or use XmlReader with secure settings.
XmlDocument doc = new XmlDocument(); doc.XmlResolver = null;
🧯 If You Can't Patch
- Avoid importing XML bookmarks from untrusted sources.
- Use network segmentation to restrict outbound HTTP requests from affected systems.
🔍 How to Verify
Check if Vulnerable:
Check PDFPatcher version in Help > About; if version is 1.1.3.4663 or earlier, it is vulnerable.Check Version:
Not applicable - check via application GUI.Verify Fix Applied:
Verify version is later than 1.1.3.4663 or check source code for secure XML parser configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns via XML import
- Outbound HTTP requests to unexpected domains during XML processing
Network Indicators:
- HTTP requests with XML data to external servers
- Unusual outbound traffic from PDFPatcher process
SIEM Query:
Process:PDFPatcher AND (EventID:4663 OR DestinationPort:80 OR DestinationPort:443) AND XML