CVE-2026-123357

GROBID local PDF conversion can run commands from filenames

GROBID · GROBID Linux local PDF conversion

First documented disclosure · Review checkpoint

Summary

Untrusted PDF filenames can cause commands to run with converter privileges.

Severity and exploitation evidence

None · 0.0/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Linux local converter treated part of a PDF filename as executable shell input.

Conditions required

A local or embedded conversion workflow must process a filename influenced by another party. The bundled REST service uses a different path.

Potential impact

Commands can run with the converter account’s permissions.

Affected versions and configurations

The CNA lists versions before 0.9.1. The maintainer advisory identifies 0.9.0. Linux local conversion only.

Fix and mitigation status

0.9.1.

Practical next steps

Upgrade to 0.9.1 and run local document conversion with limited privileges.

Operating lesson

Pass untrusted file paths as data when invoking external converters.

Evidence and limits

The CNA assigns CVSS 3.1 score 0.0 despite describing local command execution. The maintainer advisory labels the issue Low. The bundled REST service is excluded.

Sources