CVE-2026-33929

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33929", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-24T17:06:35.279Z", "datePublished": "2026-04-14T08:09:39.517Z", "dateUpdated": "2026-04-14T19:50:07.000Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.pdfbox:pdfbox-examples", "product": "Apache PDFBox Examples", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.36", "status": "affected", "version": "2.0.24", "versionType": "semver"}, {"lessThanOrEqual": "3.0.7", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kaixuan Li"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.</p><p>This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.</p><p>\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.</p><p>The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with&nbsp;/home/ABC, e.g.&nbsp;\"/home/ABCDEF\".</p><p>Users who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository.</p>"}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.\n\nThis issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.\n\n\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.\n\nThe ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with\u00a0/home/ABC, e.g.\u00a0\"/home/ABCDEF\".\n\nUsers who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-14T08:09:39.517Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/pdfbox/pull/427/changes"}, {"tags": ["mailing-list"], "url": "https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6"}], "source": {"defect": ["PDFBOX-6180"], "discovery": "EXTERNAL"}, "title": "Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T19:50:04.295675Z", "id": "CVE-2026-33929", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:50:07.000Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-33929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:50:04.295675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:49:58.797Z"}}], "cna": {"title": "Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code", "source": {"defect": ["PDFBOX-6180"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Kaixuan Li"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache PDFBox Examples", "versions": [{"status": "affected", "version": "2.0.24", "versionType": "semver", "lessThanOrEqual": "2.0.36"}, {"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.0.7"}], "packageName": "org.apache.pdfbox:pdfbox-examples", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/pdfbox/pull/427/changes", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs", "tags": ["mailing-list"]}, {"url": "https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.\n\nThis issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.\n\n\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.\n\nThe ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with\u00a0/home/ABC, e.g.\u00a0\"/home/ABCDEF\".\n\nUsers who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.</p><p>This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.</p><p>\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.</p><p>The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with&nbsp;/home/ABC, e.g.&nbsp;\"/home/ABCDEF\".</p><p>Users who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-14T08:09:39.517Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33929", "state": "PUBLISHED", "dateUpdated": "2026-04-14T19:50:07.000Z", "dateReserved": "2026-03-24T17:06:35.279Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-14T08:09:39.517Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.pdfbox:pdfbox-examples", "product": "Apache PDFBox Examples", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.36", "status": "affected", "version": "2.0.24", "versionType": "semver"}, {"lessThanOrEqual": "3.0.7", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*", "matchCriteriaId": "6575F889-F1A2-46DB-AE08-1FCD511CA44E", "versionEndExcluding": "2.0.37", "versionStartIncluding": "2.0.24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D05B9D6-455C-48FA-A899-CDC053258BF5", "versionEndExcluding": "3.0.8", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.\n\nThis issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.\n\n\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.\n\nThe ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with\u00a0/home/ABC, e.g.\u00a0\"/home/ABCDEF\".\n\nUsers who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository."}, {"lang": "es", "value": "Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido (\u2019Salto de Ruta\u2019) vulnerabilidad en los Ejemplos de Apache PDFBox.\n\nEste problema afecta al ejemplo ExtractEmbeddedFiles en Apache PDFBox: desde 2.0.24 hasta 2.0.36, desde 3.0.0 hasta 3.0.7.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.37 o 3.0.8 una vez disponibles. Hasta entonces, deber\u00edan aplicar la correcci\u00f3n proporcionada en el PR 427 de GitHub.\n\nEl ejemplo ExtractEmbeddedFiles conten\u00eda una vulnerabilidad de salto de ruta (CWE-22) mencionada en CVE-2026-23907. Sin embargo, el cambio en las versiones 2.0.36 y 3.0.7 es defectuoso porque no considera el separador de ruta de archivo. Debido a eso, un usuario con derechos de escritura en /home/ABC podr\u00eda ser v\u00edctima de un PDF malicioso resultando en un intento de escritura a cualquier ruta que comience con /home/ABC, p. ej. \u2019/home/ABCDEF\u2019.\n\nLos usuarios que han copiado este ejemplo en su c\u00f3digo de producci\u00f3n deber\u00edan aplicar el cambio mencionado. El ejemplo ha sido modificado en consecuencia y est\u00e1 disponible en el repositorio del proyecto."}], "id": "CVE-2026-33929", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33929", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T19:50:04.295675Z", "version": "2.0.3"}}]}, "published": "2026-04-14T09:16:36.297", "references": [{"source": "security@apache.org", "tags": ["Patch"], "url": "https://github.com/apache/pdfbox/pull/427/changes"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6"}, {"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "Apache PDFBox: Apache PDFBox: Arbitrary file write via path traversal in ExtractEmbeddedFiles example", "id": "2458164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458164"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Apache PDFBox. A local user with writing rights to a specific directory could be exploited via a malicious PDF file when using the ExtractEmbeddedFiles example. This path traversal (CWE-22) vulnerability, which allows an attacker to access files and directories outside of the intended directory, enables arbitrary file write attempts."], "name": "CVE-2026-33929", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "pdfbox", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "pdfbox", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Not affected", "package_name": "pdfbox", "product_name": "streams for Apache Kafka 2"}], "public_date": "2026-04-14T08:09:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33929\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33929\nhttps://github.com/apache/pdfbox/pull/427/changes\nhttps://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6\nhttps://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.24,2.0.36]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.7]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache PDFBox Examples", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "pdfbox_examples", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-14T21:52:01.499233+00:00", "value": {"mitigation_remediation": ["Update Apache PDFBox to version 2.0.37 or 3.0.8 when available.", "If a newer release is not yet available, apply the patch from GitHub pull request\u00a0427 to the ExtractEmbeddedFiles example.", "Remove or isolate the example code in production environments until a secure version is deployed.", "Verify that any copied instances of the example reflect the latest fixed code.", "Monitor advisories for PDFBox path traversal updates to stay ahead of potential exploitation."], "summary": {"action": "Immediate Patch", "impact": "Path Traversal allowing arbitrary file write within the user\u2019s home directory"}, "threat_synthesis": {"affected_systems": "This issue affects Apache Software Foundation:Apache PDFBox Examples versions 2.0.24 through 2.0.36 and 3.0.0 through 3.0.7. Users who have incorporated this example into production code should upgrade to version 2.0.37 or 3.0.8 when released, or apply the code change from GitHub pull request\u00a0427.", "description_and_impact": "The ExtractEmbeddedFiles example in Apache Software Foundation:Apache PDFBox Examples contains a path traversal flaw (CWE\u201122) that lets a crafted PDF cause the code to write to unintended files. Because the example does not handle file path separators properly, an attacker can target any path beginning with the current user\u2019s home directory prefix, creating or overwriting files and potentially exposing sensitive data or enabling further compromise.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while an EPSS score below 1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers must provide a malicious PDF to a user running the vulnerable example and require write permissions in the user's home directory. Successful exploitation would allow the attacker to create or modify files under the victim\u2019s home directory, compromising confidentiality and integrity for that user but not affecting the entire system."}}}}, "created": "2026-04-14T16:15:46.969133+00:00", "updated": "2026-04-15T15:30:06.831577+00:00", "vendors": ["apache", "apache$PRODUCT$pdfbox_examples"]}