OESA-2026-2238

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2238

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2238.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2238

Upstream

CVE-2026-33929

Published

2026-05-09T12:32:47Z

Modified

2026-05-09T12:47:55.972231Z

Summary

pdfbox security update

Details

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP1 / pdfbox

Package

Name: pdfbox
Purl: pkg:rpm/openEuler/pdfbox&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.29-2.oe2403sp1

Ecosystem specific

{
    "src": [
        "pdfbox-2.0.29-2.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "fontbox-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-debugger-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-javadoc-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-parent-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-reactor-2.0.29-2.oe2403sp1.noarch.rpm",
        "pdfbox-tools-2.0.29-2.oe2403sp1.noarch.rpm",
        "preflight-2.0.29-2.oe2403sp1.noarch.rpm",
        "xmpbox-2.0.29-2.oe2403sp1.noarch.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2238.json"