A critical directory traversal vulnerability in pdfforge PDF Architect allows remote attackers to execute arbitrary code on the host system through maliciously crafted CBZ files.

The software fails to properly validate user supplied paths during the parsing of CBZ files, leading to a path traversal vulnerability. An unauthenticated attacker can leverage this flaw to execute arbitrary code in the context of the current user, provided the user is enticed to open a malicious file.

The ability for an attacker to execute arbitrary code on a user workstation presents a severe risk of full system compromise, including data theft, malware installation, and lateral movement within the corporate network. With a CVSS score of 7.8, this high severity vulnerability poses a significant threat to operational integrity and sensitive information confidentiality.

Immediate Action: Since a specific patch is not yet confirmed, users should avoid opening unsolicited or untrusted CBZ files and monitor vendor communications for an emergency security update.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious file system activity or unexpected child processes spawned by the PDF Architect application.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to identify and block suspicious file execution patterns associated with document parsing software.

Public Exploit Available: No (exploit_available: false)

Given the severity of potential remote code execution, organizations should prioritize restricting the use of untrusted CBZ files within the environment. Administrators must remain vigilant for official patch releases from pdfforge and apply them immediately upon availability to neutralize this risk.