Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Soda PDF Desktop, specifically within the parsing of CBZ files. This issue arises from improper validation of user-supplied paths before they are used in file operations, allowing remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, as the target must open a malicious CBZ file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, in the context of the current user.

Remediation

Users are advised to restrict interaction with the product, as no specific patch or update is available.