Command Injection Affecting com.itextpdf:io package, versions [,7.1.17)

  • Exploit Maturity

    Proof of concept

  • Attack Complexity


  • Integrity


  • Availability


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    15 Dec 2021

  • disclosed

    15 Dec 2021

  • credit

    Gabriele Zuddas

How to fix?

Upgrade com.itextpdf:io to version 7.1.17 or higher.


com.itextpdf:io is a package that represents the next level of SDKs for developers that want to take advantage of the benefits PDF can bring. Equipped with a better document engine, high and low-level programming capabilities and the ability to create, edit and enhance PDF documents, iText 7 can be a boon to nearly every workflow.

Affected versions of this package are vulnerable to Command Injection. An attacker controlling the filename passed to the CompareTool class, is able to inject arbitrary parameters in the command line being executed (ghostscript). The vulnerable code resides inside com/itextpdf/io/util/ .