CVE-2025-14413: Soda PDF Desktop CBZ File RCE Vulnerability

CVE-2025-14413 Overview

CVE-2025-14413 is a directory traversal vulnerability in Soda PDF Desktop that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the parsing of CBZ archive files, where the application fails to validate user-supplied paths before performing file operations. An attacker who convinces a user to open a crafted CBZ file or visit a malicious page can write files outside the intended extraction directory and achieve code execution in the context of the current user. The issue was reported through the Zero Day Initiative as ZDI-CAN-27509 and assigned [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the logged-in user, enabling persistence, data theft, or lateral staging from a single malicious CBZ file.

Affected Products

Soda PDF Desktop 14.0.509.23030
Installations parsing CBZ archives through Soda PDF Desktop
Windows endpoints running vulnerable Soda PDF Desktop builds

Discovery Timeline

2025-12-23 - CVE-2025-14413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14413

Vulnerability Analysis

The vulnerability stems from how Soda PDF Desktop processes CBZ files. A CBZ file is a ZIP archive containing comic book images, and the application extracts these entries to disk during parsing. Soda PDF Desktop does not properly validate the file path entries embedded inside the CBZ archive before using them in file operations. An attacker can craft archive entries containing directory traversal sequences such as ..\..\ to escape the intended extraction directory. This classifies as a [CWE-22] path traversal weakness leading to arbitrary file write, which the attacker chains into code execution.

Root Cause

The root cause is the lack of canonicalization and validation of archive member names prior to file system operations. When the parser writes extracted content to disk, it concatenates attacker-controlled relative paths with a base directory without rejecting parent-directory references or absolute paths. This allows attacker-supplied file names to resolve to locations outside the intended sandbox, including auto-start directories, application binaries, or DLL search paths used by the current user.

Attack Vector

Exploitation requires user interaction. The target must open a malicious CBZ file or visit a page that delivers one. The attack vector is local, but delivery commonly occurs through phishing emails, drive-by downloads, or shared file repositories. Once the file is opened in Soda PDF Desktop, the path traversal triggers automatically, writing attacker-controlled content to a location that yields code execution under the logged-in user. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-1086.

Detection Methods for CVE-2025-14413

Indicators of Compromise

CBZ files containing archive entries with ..\ or ../ sequences in member names
Unexpected files written outside the user's Documents or Downloads directory following a CBZ open event
New executables, shortcuts, or DLLs appearing in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup after Soda PDF activity
Child processes spawned by SodaPDFDesktop.exe that are not part of normal application behavior

Detection Strategies

Monitor file write events where the parent process is SodaPDFDesktop.exe and the target path is outside the configured extraction directory
Inspect CBZ archive contents at the email or web proxy gateway for traversal sequences in ZIP central directory entries
Alert on Soda PDF Desktop spawning interpreters such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe

Monitoring Recommendations

Enable file integrity monitoring on user-writable autorun and startup locations
Forward endpoint process and file telemetry to a centralized SIEM or data lake for correlation across hosts
Track Soda PDF Desktop version inventory to confirm patched builds are deployed enterprise-wide

How to Mitigate CVE-2025-14413

Immediate Actions Required

Identify all endpoints running Soda PDF Desktop, including version 14.0.509.23030, through software inventory tools
Restrict opening of CBZ files from untrusted sources until a fixed build is installed
Block inbound CBZ attachments at email gateways and quarantine archives that contain traversal sequences
Apply the principle of least privilege so users do not run with administrative rights

Patch Information

At the time of NVD publication, no vendor advisory URL was listed in the CVE record. Administrators should consult the Zero Day Initiative Advisory ZDI-25-1086 and the Soda PDF vendor site for the latest fixed release. Upgrade Soda PDF Desktop to the vendor-supplied patched version as soon as it is available.

Workarounds

Change the default file association for .cbz files away from Soda PDF Desktop until a patch is applied
Use application allow-listing to prevent Soda PDF Desktop from launching child interpreters
Train users to avoid opening CBZ files received through email or untrusted web downloads
Deploy endpoint protection that blocks file writes from document viewers to autorun and system locations

bash

# Example: block CBZ file association via Windows registry (run as administrator)
reg delete "HKCR\.cbz" /f
reg add "HKCR\.cbz" /ve /t REG_SZ /d "" /f