Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-23907

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Pdfbox-examples Pdfbox Examples
CVE-2026-33929

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Pdfbox Pdfbox Examples
CVE-2016-2175

pdfbox: XML External Entity vulnerability

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

CVSS 3.0 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Pdfbox Debian Linux Jboss Amq and 4 more
CVE-2019-0228

pdfbox: XML External Entity (XXE) attacks via a crafted XFDF

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

CVSS 3.1 · 9.8 Critical EPSS 9.5% KEV · Not listed
Vendors
Apache Fedoraproject Oracle
Products
James Pdfbox Fedora and 11 more
CVE-2018-8036

pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

CVSS 3.0 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Apache Redhat
Products
Pdfbox Jboss Fuse