CVE-2016-2175
HighSummary
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Risk Assessment
An XXE attack can lead to the disclosure of sensitive data or unauthorized operations within the system, posing a significant security threat to the organization.
Recommendation
It is recommended to upgrade Apache PDFBox to version 1.8.12 or 2.0.1 or later to mitigate these vulnerabilities.
Other vulnerabilities in Apache PDFBox
See all- CVE-2026-33929Medium
The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.36 and 3.0.0–3.0.7) contains a path traversal vulnerability (CWE-22). The fix in 2.0.36 and 3.0.7 is flawed because it does not consider the file path separator, allowing writes to paths starting with the user's directory, e.g. /home/ABCDEF.
- CVE-2026-23907Medium
The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.
Original NVD description (English source)
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS