saadhassan77/cve-2025-64512---pdfminer.six-remote-code-execution-rce-Exploit PoC for CVE-2025-64512 targeting insecure deserialization in pdfminer.six. Generates malicious pickle payload and produces exploit PDFs for RCE via web file upload.
This proof-of-concept is for authorized security testing and educational purposes only.
Use only on systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by this code.
CVE-2025-64512 is a critical vulnerability in pdfminer.six, a popular Python library for extracting text and metadata from PDF files. The flaw allows Remote Code Execution (RCE) via insecure deserialization of pickle data when processing a malicious PDF.
The vulnerability is commonly triggered through file upload functionality in web applications that use pdfminer.six to parse uploaded PDF documents (e.g., document management systems, reporting tools, profile picture uploads accepting PDFs).
Run generate_pickle.py to create malicious.pickle.gz, which contains your reverse shell payload.
-orange){kind=icon}
python3 generate_pickle.py
Step 2 – Generate the exploit PDF
Choose one of the two available methods:
# Method 1: /Encoding path traversal (less reliable)
python3 method1_encoding_poc.py
# Method 2: /CMap deserialization (official CVE method – RECOMMENDED)
python3 method2_cmap_poc.py
Both scripts produce exploit.pdf, which references the malicious pickle file and triggers the deserialization flaw when processed.
Step 3 – Start your listener
nc -lvnp 4444
Step 4 – Upload and execute
Navigate to the target web application's file upload feature.
Upload exploit.pdf via the web interface.
The application processes the PDF using a vulnerable version of pdfminer.six.
The pickle payload deserialises and executes, granting you a reverse shell.