CVE-2019-25729CWE-352

PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie

Critical · published June 4, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information from the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00258 · 16.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-06-04T13:22Z
EPSS history
Timeline
  • 04 JUN 13:22Z
    PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie
    cvelistv5