Information disclosure in PyPDF - #VU161871
Published: November 8, 2026
Vulnerability identifier: #VU161871
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to guess sensitive placeholder values in encrypted documents created from templates.
The vulnerability exists due to information exposed through pypdf file identifiers for encrypted templated documents. An attacker can use a document with the same template and access to other documents' file identifiers to guess placeholder values without decrypting the target documents.
Affected software
PyPDF
Remediation
Install security update from vendor's website.
PyPDF - update to 7.0.0