CVE-2019-25729
PDF Signer 3.0 contains a server‑side template injection flaw that lets attackers run arbitrary PHP code by injecting payloads into the CSRF‑TOKEN cookie. The cookie is not validated, so an attacker can execute system commands and steal data from the server. The vulnerability is rated critical with a CVSS score of 9.3.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
PDF Signer 3.0 – the software used to sign PDF documents on servers. The typical user is an organization that hosts PDF Signer for document signing.
Real-world impact
An attacker can execute any command on the server, read or modify files, and exfiltrate sensitive information, effectively taking full control of the affected system.
Why this severity
The CVSS score reflects that the flaw allows remote, unauthenticated attackers to run arbitrary code with full system privileges, with no user interaction required. The impact is high on confidentiality, integrity, and availability, leading to a critical rating.
What to do about it
- ›Block or sanitize the CSRF‑TOKEN cookie to prevent PHP code injection.
- ›Disable or restrict PHP template injection features if possible.
- ›Monitor the server for suspicious activity and logs of command execution.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.