{"id":"CVE-2026-23907","aliases":["DEBIAN-CVE-2026-23907","EUVD-2026-10481","GHSA-jjwr-xmw6-gf78","UBUNTU-CVE-2026-23907"],"status":"published","title":"Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.0099,"percentile":0.6276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2026-03-10T09:43:40Z","modified":"2026-10-17T12:59:56Z","exploits":[{"source":"pocgithub","id":"JoakimBulow/CVE-2026-23907","title":"JoakimBulow/CVE-2026-23907","date":"2026-01-27","url":"https://github.com/JoakimBulow/CVE-2026-23907"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-examples","fixed_in":["3.0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.24"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2","1:1.8.16-3","1:1.8.16-4","1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.27-2","2.0.29-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.24"},{"fixed":"3.0.7"}]}],"versions":["2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","3.0.0","3.0.0-RC1","3.0.0-alpha2","3.0.0-alpha3","3.0.0-beta1","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.10-1","1:1.8.10-2","1:1.8.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.13-1","1:1.8.13-2","1:1.8.16-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.7-1","2.0.8-1","2.0.8-2","2.0.9-1","2.0.13-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.16-1","2.0.17-1","2.0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.23-1","2.0.24-2","2.0.25-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-4","1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.27-2","2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]}],"products":[{"vendor":"apache","product":"pdfbox-examples"},{"vendor":"apache software foundation","product":"apache pdfbox examples"}],"references":[{"url":"https://github.com/JoakimBulow/","tags":["Not Applicable","web"]},{"url":"https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/10/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23907","tags":["advisory"]},{"url":"https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jjwr-xmw6-gf78"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23907.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23907","tags":["advisory"]},{"url":"https://github.com/apache/pdfbox","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-23907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23907","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-23907","title":"Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","status":"published","published":"2026-03-10T09:43:40.384Z","modified":"2026-03-10T17:51:53.261Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-10481","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","status":"published","published":"2026-03-10T09:43:40Z","modified":"2026-03-10T17:51:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:04.718931Z"}],"ghsa":[{"id":"GHSA-jjwr-xmw6-gf78","title":"Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function","description":"This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.","status":"published","published":"2026-03-10T18:31:19Z","modified":"2026-03-11T18:13:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:34.616253Z"}],"nvd":[{"id":"CVE-2026-23907","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","status":"published","published":"2026-03-10T18:18:16.96Z","modified":"2026-09-17T17:22:10.357Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-23907","title":"Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","status":"published","published":"2026-03-10T09:43:40.384Z","modified":"2026-08-12T03:51:32.700382047Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-23907","description":"This issue affects the  ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.   The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because  the filename that is obtained from  PDComplexFileSpecification.getFilename() is appended to the extraction path.  Users who have copied this example into their production code should  review it to ensure that the extraction path is acceptable. The example  has been changed accordingly, now the initial path and the extraction  paths are converted into canonical paths and it is verified that  extraction path contains the initial path. The documentation has also  been adjusted.","status":"published","published":"2026-03-10T18:18:16.96Z","modified":"2026-10-01T03:03:00.399293431Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"GHSA-jjwr-xmw6-gf78","title":"Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function","description":"This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.","status":"published","published":"2026-03-10T18:31:19Z","modified":"2026-09-10T03:50:39.838609463Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"UBUNTU-CVE-2026-23907","description":"This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.","status":"published","published":"2026-03-10T18:18:00Z","modified":"2026-10-17T12:59:56.555138239Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:04.456047Z"}]}}