CVE-2026-23907
Severity
5.3MEDIUM
EPSS
0.1%
top 81.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 10
Description
This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because
the filename that is obtained from
PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should
review it to ensure that the extraction path is acceptable. The example
has been changed accordingly, …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages3 packages
🔴Vulnerability Details
4OSV▶
CVE-2026-23907: This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2↗2026-03-10
GHSA▶
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function↗2026-03-10
CVEList
▶
OSV▶
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function↗2026-03-10