PYSEC-2026-3001
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/pymupdf/PYSEC-2026-3001.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3001
- Aliases
- Published
- 2026-07-13T14:36:43.974708Z
- Modified
- 2026-07-13T16:33:07.802779002Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- PyMuPDF has a path traversal in _main_.py
- Details
-
A path traversal and arbitrary file write vulnerability exist in the embedded get function in 'main.py' in PyMuPDF version, 1.26.5.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-3029
- https://github.com/pymupdf/PyMuPDF
- https://www.kb.cert.org/vuls/id/504749
- http://github.com/pymupdf/PyMuPDF
- http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a
- https://pypi.org/project/pymupdf
- https://github.com/advisories/GHSA-cxqh-p2w9-fmr7
Affected packages
PyPI / pymupdf
Package
- Name
- pymupdf
- View open source insights on deps.dev
- Purl
- pkg:pypi/pymupdf