CVE-2026-23907

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23907", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-19T12:13:50.503Z", "datePublished": "2026-03-10T09:43:40.384Z", "dateUpdated": "2026-03-10T17:51:53.261Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.pdfbox:pdfbox-examples", "product": "Apache PDFBox Examples", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.35", "status": "affected", "version": "2.0.24", "versionType": "semver"}, {"lessThanOrEqual": "3.0.6", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Joakim B\u00fclow (Neo4j Security Team)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This issue affects the \nExtractEmbeddedFiles example in&nbsp;Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.</p><p>\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n<br>Users who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.</p>"}], "value": "This issue affects the \nExtractEmbeddedFiles example in\u00a0Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-10T17:04:48.746Z"}, "references": [{"url": "https://github.com/JoakimBulow/"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/10/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-10T13:28:02.680Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:51:34.025936Z", "id": "CVE-2026-23907", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:51:53.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/10/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-10T13:28:02.680Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23907", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T17:51:34.025936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:50:10.744Z"}}], "cna": {"title": "Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Joakim B\u00fclow (Neo4j Security Team)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache PDFBox Examples", "versions": [{"status": "affected", "version": "2.0.24", "versionType": "semver", "lessThanOrEqual": "2.0.35"}, {"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.0.6"}], "packageName": "org.apache.pdfbox:pdfbox-examples", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/JoakimBulow/"}, {"url": "https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "This issue affects the \nExtractEmbeddedFiles example in\u00a0Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.", "supportingMedia": [{"type": "text/html", "value": "<p>This issue affects the \nExtractEmbeddedFiles example in&nbsp;Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.</p><p>\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n<br>Users who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-10T17:04:48.746Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23907", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:51:53.261Z", "dateReserved": "2026-01-19T12:13:50.503Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-03-10T09:43:40.384Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.pdfbox:pdfbox-examples", "product": "Apache PDFBox Examples", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.35", "status": "affected", "version": "2.0.24", "versionType": "semver"}, {"lessThanOrEqual": "3.0.6", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:*", "matchCriteriaId": "41D7F404-F89C-409D-89B8-363197958350", "versionEndIncluding": "2.0.36", "versionStartIncluding": "2.0.24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D586601-B04F-4349-A88D-9D36693022E7", "versionEndIncluding": "3.0.7", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue affects the \nExtractEmbeddedFiles example in\u00a0Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted."}, {"lang": "es", "value": "Este problema afecta al ejemplo ExtractEmbeddedFiles en Apache PDFBox: desde 2.0.24 hasta 2.0.35, desde 3.0.0 hasta 3.0.6.\n\nEl ejemplo ExtractEmbeddedFiles contiene una vulnerabilidad de salto de ruta (CWE-22) porque el nombre de archivo que se obtiene de PDComplexFileSpecification.getFilename() se a\u00f1ade a la ruta de extracci\u00f3n.\n\nLos usuarios que han copiado este ejemplo en su c\u00f3digo de producci\u00f3n deber\u00edan revisarlo para asegurarse de que la ruta de extracci\u00f3n es aceptable. El ejemplo ha sido modificado en consecuencia, ahora la ruta inicial y las rutas de extracci\u00f3n se convierten en rutas can\u00f3nicas y se verifica que la ruta de extracci\u00f3n contiene la ruta inicial. La documentaci\u00f3n tambi\u00e9n ha sido ajustada."}], "id": "CVE-2026-23907", "lastModified": "2026-09-17T17:22:10.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23907", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:51:34.025936Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:16.960", "references": [{"source": "security@apache.org", "tags": ["Not Applicable"], "url": "https://github.com/JoakimBulow/"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/10/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.pdfbox:pdfbox-examples: Apache PDFBox Example: Path Traversal via specially crafted filenames allows arbitrary file write", "id": "2445994", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445994"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A Path Traversal flaw was found in the `ExtractEmbeddedFiles` example within Apache PDFBox. An attacker could craft a malicious PDF file containing embedded file entries with specially crafted filenames containing directory traversal sequences (for example ../). When processed by applications that copied this example code, files may be written outside the intended extraction directory, potentially leading to data corruption or unauthorized file creation."], "mitigation": {"lang": "en:us", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available."}, "name": "CVE-2026-23907", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "pdfbox-io", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "pdfbox-tools", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "pdfbox-tools", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "pdfbox-tools", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "pdfbox-io", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "pdfbox-tools", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "pdfbox-io", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "pdfbox-tools", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-03-10T09:43:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23907\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23907\nhttps://github.com/JoakimBulow/\nhttps://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw"], "statement": "The vulnerable code exists in the example implementation shipped with Apache PDFBox and is not part of the core library functionality. \nApplications that copied or reused the ExtractEmbeddedFiles example code without adding proper path validation may allow path traversal during extraction of embedded files from PDF documents. The impact is limited to the permissions of the application processing the PDF.\nSystems that do not use this example code or that properly sanitize extraction paths are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.24,2.0.36]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.7]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "pdfbox_examples", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-16T09:52:56.525812+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest release of Apache PDFBox, which includes the patched ExtractEmbeddedFiles example (any 2.0.36+ or 3.0.7+).", "If an upgrade is not possible, modify your code to validate the extraction path: compute the canonical path of the target file and confirm it begins with the intended base directory before writing the file.", "Remove or disable the ExtractEmbeddedFiles example from production code; implement a custom extraction routine that enforces strict path checks.", "Audit the application to ensure that the PDF processing runs with the least privileges required, limiting potential damage from a traversal.", "Maintain regular updates from the Apache PDFBox project and monitor advisories for any future changes."], "summary": {"action": "Apply Update", "impact": "Path Traversal"}, "threat_synthesis": {"affected_systems": "Apache Software Foundation\u2019s PDFBox Examples are affected. The vulnerability exists in versions 2.0.24 through 2.0.35 and in 3.0.0 through 3.0.6. Any code that copies this example into production and runs it against untrusted PDFs would be vulnerable.", "description_and_impact": "The ExtractEmbeddedFiles example in Apache PDFBox contains a path traversal flaw (CWE\u201122). When a PDF references an embedded file, the filename returned by PDComplexFileSpecification.getFilename() is simply appended to a base extraction directory. An attacker can supply a filename that includes traversal sequences, causing the extraction code to write or read files outside the intended directory, potentially overwriting existing files or exposing sensitive data.", "risk_and_exploitability": "The CVSS score is 5.3, marking it as a medium\u2011severity flaw, and the EPSS score is below 1\u202f%, indicating a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the vulnerability requires a PDF with a specially crafted filename and execution of the example code, it is a local\u2011level threat that could be triggered by a malicious file processed by an application running with elevated privileges. After the library authors updated the example to canonicalise paths and verify containment, the risk is mitigated if the latest example is used."}}}}, "created": "2026-03-11T11:50:25.218121+00:00", "updated": "2026-04-16T10:00:14.076038+00:00", "vendors": ["apache", "apache$PRODUCT$pdfbox_examples"]}