CVE-2026-23907

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23907
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/JoakimBulow/ Not Applicable
https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/10/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
History

13 Mar 2026, 16:45

Type Values Removed Values Added
Summary
  • (es) Este problema afecta al ejemplo ExtractEmbeddedFiles en Apache PDFBox: desde 2.0.24 hasta 2.0.35, desde 3.0.0 hasta 3.0.6. El ejemplo ExtractEmbeddedFiles contiene una vulnerabilidad de salto de ruta (CWE-22) porque el nombre de archivo que se obtiene de PDComplexFileSpecification.getFilename() se añade a la ruta de extracción. Los usuarios que han copiado este ejemplo en su código de producción deberían revisarlo para asegurarse de que la ruta de extracción es aceptable. El ejemplo ha sido modificado en consecuencia, ahora la ruta inicial y las rutas de extracción se convierten en rutas canónicas y se verifica que la ruta de extracción contiene la ruta inicial. La documentación también ha sido ajustada.
First Time Apache
Apache pdfbox
CPE cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
References () https://github.com/JoakimBulow/ - () https://github.com/JoakimBulow/ - Not Applicable
References () https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw - () https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/03/10/1 - () http://www.openwall.com/lists/oss-security/2026/03/10/1 - Mailing List, Third Party Advisory

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-13 16:45

NVD link : CVE-2026-23907

Mitre link : CVE-2026-23907

CVE.ORG link : CVE-2026-23907

JSON object : View

Products Affected

apache

  • pdfbox
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')