CVE-2026-23907
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
CVE-2026-23907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-10481
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
EUVD-2026-10481- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jjwr-xmw6-gf78
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
GHSA-jjwr-xmw6-gf78- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
CVE-2026-23907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
CVE-2026-23907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-23907
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
DEBIAN-CVE-2026-23907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-jjwr-xmw6-gf78
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
GHSA-jjwr-xmw6-gf78- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-23907
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Record
UBUNTU-CVE-2026-23907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.pdfbox:pdfbox-examplesMaven |
2.0.24 up to 3.0.7 | 3.0.7 |
libpdfbox-javaDebian:12 |
All versions, plus listed versions 1:1.8.16-21:1.8.16-31:1.8.16-41:1.8.16-51:1.8.17-1 |
None known |
libpdfbox-javaDebian:13 |
All versions, plus listed versions 1:1.8.16-51:1.8.17-1 |
None known |
libpdfbox-javaDebian:14 |
All versions, plus listed versions 1:1.8.16-51:1.8.17-1 |
None known |
libpdfbox2-javaDebian:12 |
All versions, plus listed versions 2.0.27-22.0.29-1 |
None known |
libpdfbox2-javaDebian:13 |
All versions, plus listed versions 2.0.29-1 |
None known |
libpdfbox2-javaDebian:14 |
All versions, plus listed versions 2.0.29-1 |
None known |
org.apache.pdfbox:pdfbox-examplesMaven |
2.0.24 up to 3.0.7, plus listed versions 2.0.252.0.262.0.272.0.282.0.29 Show 18 moreShow less2.0.302.0.312.0.322.0.332.0.342.0.352.0.363.0.03.0.0-RC13.0.0-alpha23.0.0-alpha33.0.0-beta13.0.13.0.23.0.33.0.43.0.53.0.6 |
3.0.7 |
libpdfbox-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1:1.8.7+dfsg-11:1.8.10-11:1.8.10-21:1.8.11+dfsg-1 |
None known |
libpdfbox-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.8.13-11:1.8.13-21:1.8.16-2~18.04 |
None known |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libpdfbox2-javaUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.7-12.0.8-12.0.8-22.0.9-12.0.13-2~18.04 |
None known |
libpdfbox-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.8.16-2 |
None known |
libpdfbox2-javaUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.16-12.0.17-12.0.18-1 |
None known |
libpdfbox-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.8.16-2 |
None known |
libpdfbox2-javaUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.23-12.0.24-22.0.25-1 |
None known |
libpdfbox-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.8.16-41:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:24.04:LTS |
All versions, plus listed versions 2.0.27-22.0.29-1 |
None known |
libpdfbox-javaUbuntu:25.10 |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:25.10 |
All versions, plus listed versions 2.0.29-1 |
None known |
libpdfbox-javaUbuntu:26.10 |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:26.10 |
All versions, plus listed versions 2.0.29-1 |
None known |
libpdfbox-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:26.04:LTS |
All versions, plus listed versions 2.0.29-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | JoakimBulow/CVE-2026-23907 | 2026-01-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-23907 is a medium vulnerability (CVSS 5.3) in Apache Software Foundation Pdfbox Examples, published March 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in org.apache.pdfbox:pdfbox-examples 3.0.7.