CVE-2026-33929: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.
Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.
The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".
Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33929?
CVE-2026-33929 is classified as a medium severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2026-33929?
To fix CVE-2026-33929, upgrade Apache PDFBox to versions 2.0.36 or later, or 3.0.8 or later.
What software does CVE-2026-33929 affect?
CVE-2026-33929 affects Apache PDFBox version 2.0.24 to 2.0.36 and 3.0.0 to 3.0.7.
What is path traversal in the context of CVE-2026-33929?
In the context of CVE-2026-33929, path traversal allows an attacker to access files outside the restricted directory.
How can I identify if my system is vulnerable to CVE-2026-33929?
You can identify if your system is vulnerable to CVE-2026-33929 by checking the version of Apache PDFBox in use and verifying it falls within the affected range.