GHSA-jjwr-xmw6-gf78

Source

https://github.com/advisories/GHSA-jjwr-xmw6-gf78

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-jjwr-xmw6-gf78/GHSA-jjwr-xmw6-gf78.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jjwr-xmw6-gf78

Aliases

CVE-2026-23907

Published

2026-03-10T18:31:19Z

Modified

2026-09-10T03:50:39Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function

Details

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.

The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.

Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-11T18:13:49Z",
    "nvd_published_at":  "2026-03-10T18:18:16Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.pdfbox:pdfbox-examples

Package

Name: org.apache.pdfbox:pdfbox-examples; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pdfbox/pdfbox-examples

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.24

Fixed

3.0.7

Affected versions

2.*

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

3.*

3.0.0-alpha2

3.0.0-alpha3

3.0.0-beta1

3.0.0-RC1

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-jjwr-xmw6-gf78/GHSA-jjwr-xmw6-gf78.json"