CVE-2026-23907
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
10/03/2026
Last modified:
13/03/2026
Description
This issue affects the <br />
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.<br />
<br />
<br />
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because <br />
the filename that is obtained from <br />
PDComplexFileSpecification.getFilename() is appended to the extraction path.<br />
<br />
Users who have copied this example into their production code should <br />
review it to ensure that the extraction path is acceptable. The example <br />
has been changed accordingly, now the initial path and the extraction <br />
paths are converted into canonical paths and it is verified that <br />
extraction path contains the initial path. The documentation has also <br />
been adjusted.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* | 2.0.24 (including) | 2.0.35 (including) |
| cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.0.7 (including) |
To consult the complete list of CPE names with products and versions, see this page