CVE-2016-2175

High

Published: 01/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Risk Assessment

An XXE attack can lead to the disclosure of sensitive data or unauthorized operations within the system, posing a significant security threat to the organization.

Recommendation

It is recommended to upgrade Apache PDFBox to version 1.8.12 or 2.0.1 or later to mitigate these vulnerabilities.

Other vulnerabilities in Apache PDFBox

CVE-2026-23907Medium
The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.

Original NVD description (English source)

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.