Exploit for CVE-2025-66034

kitploit · 2026-08-28

Description

fontTools varLib arbitrary file write and XML injection in .designspace files enables pre-auth RCE.

Affected Fonttools versions

Fonttools< 4.60.2

All known vulnerabilities by product

Debian Linuxmint Ubuntu Fonttools

CVSS 9.8 for CVE-2025-66034

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:NONE

Integrity:HIGH

Availability:LOW

EPSS Score

0.5%higher than 43.8% of all CVEs

Updated 2026-09-03

CVE Information

Exploit Details

Modified:2026-08-28 22:48

Last Seen:2026-08-29 09:55

Reporter:KitPloit

Tags

fontTools varLibarbitrary file writeXML injection.designspace filesremote code execution

Other exploits for CVE-2025-66034

POC-CVE-2025-66034

2026-09-02 KitPloitKITPLOIT

CVE-2025-66034-htb-ctf

2026-09-01 KitPloitKITPLOIT

Variatype.htb-CVE-2025-66034

2026-08-29 KitPloitKITPLOIT

varlib-cve-2025-66034

2026-08-29 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

2026-04-07 jwsly12GITHUB

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

2026-03-28 4nuxdGITHUB

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

2026-03-21 v3cn4x00GITHUB

Exploit Code

MARKDOWN10 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-4NUXD-CVE-2025-66034
# CVE-2025-66034 — fontTools varLib Scrittura Arbitraria di File → RCE

> **PoC exploit per una vulnerabilità di Scrittura Arbitraria di File + Iniezione XML in`fontTools.varLib`** Testato su HackTheBox — VarIaType

* * *

## Vulnerabilità

`fontTools.varLib` elabora file XML `.designspace` per creare font variabili. Due debolezze si combinano per ottenere RCE senza autenticazione: