Arbitrary File Access Vulnerability in Ghostscript Prior to 10.05.0
Summary
CVE-2025-27837: An issue was discovered in Artifex Ghostscript before 10.05.0. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is essential for applications that require document manipulation, printing, and conversion. However, prior to version 10.05.0, Ghostscript is vulnerable to an issue that allows access to arbitrary files due to improper handling of truncated paths with invalid UTF-8 characters.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.05.0. The vulnerability arises from the software's failure to properly validate file paths, allowing attackers to exploit truncated paths containing invalid UTF-8 characters. This could lead to unauthorized access to sensitive files on the system, posing a significant security risk.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive files and directories to mitigate the risk of unauthorized access until the software is updated. Additionally, validating and sanitizing file paths before processing them can help reduce exposure to this vulnerability.
Conclusion
The vulnerability CVE-2025-27837 in Ghostscript prior to version 10.05.0 poses a significant security risk due to improper handling of file paths. Users are strongly advised to update to the latest version to mitigate this risk. Temporary workarounds can be implemented, but updating is the most effective solution.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-27837 is a vulnerability in Ghostscript that allows access to arbitrary files through improperly handled file paths.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, which could lead to data breaches or exploitation of the system.
Yes, the vulnerability is patched in Ghostscript version 10.05.0 and later.
If an immediate update is not possible, consider implementing access controls and validating file paths to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
