CVE-2026-82035: PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects() in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyMuPDFto a version that resolves this vulnerability.Fixed in 1.28.2Patch b2c8f3a - Compensating control
Until upgraded, use a constrained service environment (e.g., run the process in a sandbox/container with no access to sensitive filesystem locations) to limit the impact of arbitrary file writes outside the intended output directory.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or services that run PyMuPDF's extract_objects() on untrusted PDF, EPUB, XPS, or FB2 files are exposed, particularly when they provide an output directory for extracted objects. The vulnerable font-processing branch uses a document-controlled BaseFont name when constructing the output filename.
What does an attacker need to exploit it?
An attacker needs to supply a crafted supported document whose BaseFont name contains encoded path separators that decode to ../ sequences or an absolute path. Exploitation does not require authentication or elevated privileges, but requires a user or service to process the malicious file with extract_objects().
What is the impact of successful exploitation?
A crafted document can cause arbitrary files to be written outside the output directory selected by the user. The reported impact includes integrity loss and limited availability impact.
What should be done if updating is not immediately possible?
Do not use extract_objects() on untrusted PDF, EPUB, XPS, or FB2 files until the fix is applied. Restrict processing to trusted documents where possible, since the unsafe filename originates from document-controlled font metadata.
Which versions are affected and what fixes the issue?
PyMuPDF through version 1.28.2 is affected. The issue is fixed in commit b2c8f3a859fed35c379a44df566f770dc3e18605.