Medium [CVE-2026-23907 +1] Apache PDFBox Examples: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This medium-severity Apache Software Foundation advisory covers CVE-2026-23907 and CVE-2026-33929 affecting Apache PDFBox Examples, Apache PDFBox.
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.
Users are recommended to update to version 2.0.37 or 3.0.8 once available.
Until then, they should apply the fix provided in GitHub PR 427.
The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator.
Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".
Users who have copied this example into their production code should apply the mentioned change.
- 2.0.24 through 2.0.36
- 3.0.0 through 3.0.7.
- through 3.0.7
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 2.0.37
- 3.0.8
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation
Upgrade to a fixed release: 2.0.37, 3.0.8. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.