CVE-2026-33929
published 2026-04-14CVE-2026-33929: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.71%
49.2th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.
Users are recommended to update to version 2.0.37 or 3.0.8 once
available. Until then, they should apply the fix provided in GitHub PR
427.
The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".
Users who have copied this example into their production code should apply the mentioned change. The example
has been changed accordingly and is available in the project repository.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | pdfbox | >= 2.0.24 < 2.0.37 | 2.0.37 |
| apache | pdfbox | >= 3.0.0 < 3.0.8 | 3.0.8 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
ghsa5.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
ghsa·2026-04-14·CVSS 5.3
CVE-2026-33929 [MEDIUM] CWE-22 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.
Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.
The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulti
Red Hat
Apache PDFBox: Apache PDFBox: Arbitrary file write via path traversal in ExtractEmbeddedFiles example
vendor_redhat·2026-04-14·CVSS 4.3
CVE-2026-33929 [MEDIUM] CWE-22 Apache PDFBox: Apache PDFBox: Arbitrary file write via path traversal in ExtractEmbeddedFiles example
Apache PDFBox: Apache PDFBox: Arbitrary file write via path traversal in ExtractEmbeddedFiles example
A flaw was found in Apache PDFBox. A local user with writing rights to a specific directory could be exploited via a malicious PDF file when using the ExtractEmbeddedFiles example. This path traversal (CWE-22) vulnerability, which allows an attacker to access files and directories outside of the intended directory, enables arbitrary file write attempts.
Package: pdfbox (Red Hat AMQ Broker 7) - Not affected
Package: pdfbox (Red Hat build of Apache Camel for Spring Boot 4) - Fix deferred
Package: pdfbox (Red Hat Data Grid 8) - Fix deferred
Package: pdfbox (Red Hat Fuse 7) - Fix deferred
Package: pdfbox (Red Hat JBoss Enterprise Application Platform 7) - Fix deferred
Package: pdfbox (R
No detection rules found.
No public exploits indexed.
2026-04-14
Published