CVE-2023-39506

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

PDF-XChange Editor createDataObject Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the createDataObject method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20594.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
PDF-XChange	PDF-XChange Editor	9.5.367.0
pdf-xchange	pdf-xchange_editor	< 9.5.368; < 10.0.0.1

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1147/Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1147/Third Party Advisory

Timeline

Published: May 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-395076.1Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to CVE-2023-395088.8Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundat CVE-2023-395097.2A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary c CVE-2023-395104.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395114.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395124.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395135.4Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395145.4Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395154.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395164.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-395175.4Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clic CVE-2023-395185.4social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1