CVE-2025-27837: Artifex Ghostscript Path Traversal Issue

CVE-2025-27837 Overview

A path traversal vulnerability has been discovered in Artifex Ghostscript before version 10.05.0 that allows unauthorized access to arbitrary files on the system. The vulnerability occurs through improper handling of truncated paths containing invalid UTF-8 characters in the Windows-specific components base/gp_mswin.c and base/winrtsup.cpp. This flaw enables attackers to bypass path restrictions and read or write files outside intended directories.

Critical Impact

Attackers can exploit this vulnerability to access arbitrary files on vulnerable systems through malformed UTF-8 path sequences, potentially leading to information disclosure, data tampering, or system compromise.

Affected Products

• Artifex Ghostscript versions prior to 10.05.0
• Windows deployments using base/gp_mswin.c and base/winrtsup.cpp components
• Applications and services utilizing vulnerable Ghostscript installations for document processing

Discovery Timeline

• 2025-03-25 - CVE-2025-27837 published to NVD
• 2025-04-01 - Last updated in NVD database

Technical Details for CVE-2025-27837

Vulnerability Analysis

This vulnerability falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in how Ghostscript handles file paths on Windows systems, specifically within the base/gp_mswin.c and base/winrtsup.cpp source files.

The core issue stems from insufficient validation of file paths that contain truncated or malformed UTF-8 character sequences. When processing such paths, the application fails to properly sanitize directory traversal sequences, allowing an attacker to escape the intended directory structure and access files elsewhere on the filesystem.

This network-accessible vulnerability requires no user interaction or prior authentication to exploit, making it particularly dangerous in environments where Ghostscript processes untrusted input such as PDF files or PostScript documents from external sources.

Root Cause

The vulnerability originates from improper input validation in the Windows-specific file handling code. The base/gp_mswin.c and base/winrtsup.cpp components do not adequately validate or sanitize file paths containing invalid UTF-8 character sequences. When these truncated UTF-8 characters are encountered, the path canonicalization logic fails to properly resolve the path, enabling directory traversal attacks.

The Windows API's handling of malformed Unicode strings, combined with Ghostscript's insufficient path validation, creates a condition where specially crafted paths can bypass security controls designed to restrict file access to specific directories.

Attack Vector

The attack can be initiated remotely over the network without requiring authentication. An attacker can craft a malicious document (such as a PDF or PostScript file) containing embedded file path references with truncated UTF-8 characters. When Ghostscript processes this document, the malformed path sequences bypass the directory restrictions.

The vulnerability mechanism relies on the following attack pattern:

1. Attacker crafts a document containing file operations with paths that include truncated/invalid UTF-8 sequences
2. The malformed UTF-8 characters cause path parsing to behave unexpectedly
3. Directory traversal sequences (such as ../) embedded within or after the invalid characters bypass validation
4. Ghostscript accesses files outside the intended directory, potentially reading sensitive system files or writing malicious content

For detailed technical information on the vulnerability mechanism, refer to the Ghostscript Bug Report #708238.

Detection Methods for CVE-2025-27837

Indicators of Compromise

• Unexpected file access attempts from Ghostscript processes targeting system directories or sensitive files
• Log entries showing file paths with unusual Unicode sequences or encoding errors
• Ghostscript process accessing files outside designated working directories
• Document processing errors followed by unauthorized file system activity

Detection Strategies

• Monitor Ghostscript process file system calls for access to paths containing invalid UTF-8 sequences or directory traversal patterns
• Implement file integrity monitoring on sensitive directories that should not be accessed by document processing applications
• Configure endpoint detection to alert on Ghostscript processes attempting to read or write files outside whitelisted directories
• Review application logs for path canonicalization errors or Unicode handling exceptions

Monitoring Recommendations

• Enable verbose logging for Ghostscript installations processing external documents
• Deploy SentinelOne agents with behavioral AI to detect anomalous file access patterns from document processing applications
• Set up alerts for any Ghostscript process accessing files in sensitive system directories such as C:\Windows\ or user profile locations
• Monitor network traffic for potentially malicious documents being submitted to Ghostscript processing endpoints

How to Mitigate CVE-2025-27837

Immediate Actions Required

• Upgrade Artifex Ghostscript to version 10.05.0 or later immediately
• If immediate patching is not possible, restrict network access to systems running vulnerable Ghostscript versions
• Implement strict input validation on any documents processed by Ghostscript
• Review and restrict file system permissions for the Ghostscript process to limit impact of potential exploitation

Patch Information

Artifex has addressed this vulnerability in Ghostscript version 10.05.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix addresses the improper path handling in both base/gp_mswin.c and base/winrtsup.cpp to properly validate and sanitize file paths containing UTF-8 characters.

Patch details and technical information can be found in the Ghostscript Bug Report #708238.

Workarounds

• Run Ghostscript in a sandboxed environment with restricted file system access to minimize the impact of path traversal
• Use -dSAFER flag when invoking Ghostscript to enable restricted operation mode, though this may not fully mitigate the vulnerability
• Implement application-level input validation to reject documents containing suspicious path references or unusual character sequences
• Deploy Web Application Firewalls or input filters to sanitize uploaded documents before Ghostscript processing

# Example: Running Ghostscript in safer mode with restricted permissions
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=output.pdf input.ps

# Verify installed Ghostscript version
gs --version
# Ensure output shows 10.05.0 or higher