CVE-2026-33929
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.36 and 3.0.0–3.0.7) contains a path traversal vulnerability (CWE-22). The fix in 2.0.36 and 3.0.7 is flawed because it does not consider the file path separator, allowing writes to paths starting with the user's directory, e.g. /home/ABCDEF.
Risk Assessment
A malicious PDF could cause writes outside the intended directory, potentially overwriting files or exposing data.
Recommendation
Update to version 2.0.37 or 3.0.8, and until then apply the fix from GitHub PR 427 if the example was copied into production code.
Other vulnerabilities in Apache PDFBox
See all- CVE-2016-2175High
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
- CVE-2026-23907Medium
The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS