GHSA-gcj8-76p4-g2fq

Source

https://github.com/advisories/GHSA-gcj8-76p4-g2fq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gcj8-76p4-g2fq/GHSA-gcj8-76p4-g2fq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gcj8-76p4-g2fq

Aliases

CVE-2026-33929

Published

2026-04-14T09:30:45Z

Modified

2026-04-15T00:16:14Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-14T23:42:00Z",
    "nvd_published_at":  "2026-04-14T09:16:36Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.pdfbox:pdfbox-examples

Package

Name: org.apache.pdfbox:pdfbox-examples; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pdfbox/pdfbox-examples

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.24

Fixed

2.0.37

Affected versions

2.*

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

Database specific

last_known_affected_version_range

"<= 2.0.36"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gcj8-76p4-g2fq/GHSA-gcj8-76p4-g2fq.json"

Maven / org.apache.pdfbox:pdfbox-examples

Package

Name: org.apache.pdfbox:pdfbox-examples; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pdfbox/pdfbox-examples

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.8

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

Database specific

last_known_affected_version_range

"<= 3.0.7"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gcj8-76p4-g2fq/GHSA-gcj8-76p4-g2fq.json"