CVE-2026-33929

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33929
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33929.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33929
Aliases
Downstream
Related
Published
2026-04-14T08:09:39.517Z
Modified
2026-07-15T01:48:54.684308760Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33929.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/pdfbox

Affected ranges

Type
GIT
Repo
https://github.com/apache/pdfbox
Events
Introduced
8876e8e1a0adbf619cef4638cc3cea073e3ca484
Fixed
f28b6571b309e10997e35cdd16b776602bab47c7
Introduced
47e7cff248d0ac17b7c03d9eb208e34a5c00bc42
Fixed
928581dc0cd44b0b8b3a83f74d223049db69844d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0.24"
        },
        {
            "fixed": "2.0.36"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.7"
        }
    ],
    "source": "DESCRIPTION"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33929.json"