CVE-2026-33929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33929
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/pdfbox/pull/427/changes Patch
https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6 Mailing List Vendor Advisory
https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
History

20 Apr 2026, 16:58

Type Values Removed Values Added
CPE cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*
First Time Apache
Apache pdfbox
References () https://github.com/apache/pdfbox/pull/427/changes - () https://github.com/apache/pdfbox/pull/427/changes - Patch
References () https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6 - () https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6 - Mailing List, Vendor Advisory
References () https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs - () https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs - Mailing List

14 Apr 2026, 20:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

14 Apr 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-14 09:16

Updated : 2026-04-20 16:58

NVD link : CVE-2026-33929

Mitre link : CVE-2026-33929

CVE.ORG link : CVE-2026-33929

JSON object : View

Products Affected

apache

  • pdfbox
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')