CVE-2026-33929

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.

Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

These are all security issues fixed in the apache-pdfbox-2.0.36-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-pdfbox fixes the following issues:

Update to version 2.0.36.

Security issues fixed:

• CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes (bsc#1262046).

Other updates and bugfixes:

• Version 2.0.36:
  • XMPBox removes namespaces on serialization
  • False negative on PDFA-1b validation : missing field type
  • PlainText.Paragraph.getLines extremely slow on long lines
  • Valid PDF/A 1B is rejected
  • Potential StackOverflows in BaseParser
  • Unknown code in Huffman RLE stream
  • IllegalArgumentException: Can't add attribute to 0-length text
  • TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing ConcurrentModificationException to be thrown
  • IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()
  • Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4 document
  • allow new PDF/A-4 conformance levels
  • pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)
  • Cmd line docs
  • IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()
  • XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
  • NullPointerException in FontMapperImpl.getFontMatches()
  • border style in FDFAnnotation is not initialized if width is 0
  • German umlauts are not rendered
  • Invalid type in Schema not detected when in XML attributes
  • Serializing produces date "1-01-01T00:00:00+01:00"
  • Seconds of date "D:2015-02-03T10:11:12" returned as 0
  • Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema
  • ClassCastException in XMPMediaManagementSchema.getHistory()
  • IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()
  • IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with RASTERIZE_DPI_AUTO
  • DateConverter fails on valid date
  • ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()
  • tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality
  • ClassCastException: class org.apache.xmpbox.type.FlashType
  • Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property: rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action
  • XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode
  • XmpParsingException: Unknown property value type : Open Choice of Integer
  • XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/
  • date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"
  • XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in lenient mode
  • Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/ http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas
  • NegativeArraySizeException in PredictorOutputStream()
  • NullpointerException in PDAcroForm.getField(Line 485)
  • OutOfMemoryError when trying to extract text from pdf
  • Outlines circular reference vulnerability
  • Rendered text missing
  • Inverted images due to enlarged decode array
  • PDF displays garbled characters in Adobe Reader but renders correctly in web browsers
  • NullPointerException while merging PDFs with output intents
  • Valid XMP Extension Schema rejected
  • Remove dead code from PDFMarkedContentExtractor
  • Include test file in test class
  • Get and Add PageTextSchema
  • Remove / deprecate TypeMapping.getAssociatedSchemaObject()
  • Support Seq / Bag mixup in lenient mode -…

This update for apache-pdfbox fixes the following issues:

Update to version 2.0.36.

Security issues fixed:

• CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes (bsc#1262046).

Other updates and bugfixes:

• Version 2.0.36:
  • XMPBox removes namespaces on serialization
  • False negative on PDFA-1b validation : missing field type
  • PlainText.Paragraph.getLines extremely slow on long lines
  • Valid PDF/A 1B is rejected
  • Potential StackOverflows in BaseParser
  • Unknown code in Huffman RLE stream
  • IllegalArgumentException: Can't add attribute to 0-length text
  • TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing ConcurrentModificationException to be thrown
  • IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()
  • Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4 document
  • allow new PDF/A-4 conformance levels
  • pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)
  • Cmd line docs
  • IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()
  • XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
  • NullPointerException in FontMapperImpl.getFontMatches()
  • border style in FDFAnnotation is not initialized if width is 0
  • German umlauts are not rendered
  • Invalid type in Schema not detected when in XML attributes
  • Serializing produces date "1-01-01T00:00:00+01:00"
  • Seconds of date "D:2015-02-03T10:11:12" returned as 0
  • Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema
  • ClassCastException in XMPMediaManagementSchema.getHistory()
  • IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()
  • IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with RASTERIZE_DPI_AUTO
  • DateConverter fails on valid date
  • ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()
  • tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality
  • ClassCastException: class org.apache.xmpbox.type.FlashType
  • Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property: rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action
  • XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode
  • XmpParsingException: Unknown property value type : Open Choice of Integer
  • XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/
  • date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"
  • XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in lenient mode
  • Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/ http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas
  • NegativeArraySizeException in PredictorOutputStream()
  • NullpointerException in PDAcroForm.getField(Line 485)
  • OutOfMemoryError when trying to extract text from pdf
  • Outlines circular reference vulnerability
  • Rendered text missing
  • Inverted images due to enlarged decode array
  • PDF displays garbled characters in Adobe Reader but renders correctly in web browsers
  • NullPointerException while merging PDFs with output intents
  • Valid XMP Extension Schema rejected
  • Remove dead code from PDFMarkedContentExtractor
  • Include test file in test class
  • Get and Add PageTextSchema
  • Remove / deprecate TypeMapping.getAssociatedSchemaObject()
  • Support Seq / Bag mixup in lenient mode -…