{"id":"CVE-2026-3029","aliases":["DEBIAN-CVE-2026-3029","EUVD-2026-13117","GHSA-cxqh-p2w9-fmr7","PYSEC-2026-3001","UBUNTU-CVE-2026-3029","openSUSE-SU-2026:10416-1","openSUSE-SU-2026:20887-1"],"status":"published","title":"CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00376,"percentile":0.31885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-03-19T15:53:38Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"PyPI","package":"pymupdf","fixed_in":["1.26.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"pymupdf","fixed_in":["1.25.4+ds1-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pymupdf","fixed_in":["1.26.7+ds1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-PyMuPDF","fixed_in":["1.27.2.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.5"},{"fixed":"1.26.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1+ds1-1","1.22.5+ds1-1","1.23.7+ds1-1","1.24.2+ds1-1","1.24.2+ds1-2","1.24.2+ds1-3","1.25.0+ds1-1","1.25.0+ds1-2","1.25.4+ds1-1","1.25.4+ds1-2","1.25.4+ds1-3","1.25.4+ds1-4","1.26.7+ds1-1","1.28.2+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.4+ds1-3+deb13u1"}]}],"versions":["1.25.4+ds1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7+ds1-1"}]}],"versions":["1.25.4+ds1-3","1.25.4+ds1-4"]},{"source":"osv","ecosystem":"PyPI","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.5"},{"fixed":"1.26.7"}]}],"versions":["1.26.5","1.26.6"]},{"source":"osv","ecosystem":"PyPI","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.5"},{"fixed":"1.26.7"}]}],"versions":["1.26.5","1.26.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.4+ds1-2build2","1.17.4+ds1-2build3","1.19.2+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.5+ds1-1","1.22.5+ds1-1build1","1.22.5+ds1-1build2","1.23.7+ds1-1ubuntu1","1.23.7+ds1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pymupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0+ds1-2build1","1.25.4+ds1-3","1.25.4+ds1-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-PyMuPDF","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2.2-1.1"}]}]}],"products":[{"vendor":"artifex software inc. *pymupdf*","product":"pymupdf"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"}],"references":[{"url":"http://github.com/pymupdf/PyMuPDF","tags":["package","web","report"]},{"url":"http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a","tags":["fix","web","report"]},{"url":"https://www.kb.cert.org/vuls/id/504749","tags":["web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3029","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449054","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3029.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3029","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cxqh-p2w9-fmr7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3029.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-3029","tags":["advisory"]},{"url":"https://github.com/pymupdf/PyMuPDF","tags":["package"]},{"url":"https://pypi.org/project/pymupdf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-3029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3029","tags":["report"]},{"url":"https://github.com/pymupdf/PyMuPDF/issues/4767","tags":["report"]},{"url":"https://github.com/pymupdf/PyMuPDF/commit/756e1ee94421fb7c570ef49bfdac21c72025417d","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3029","tags":["web"]},{"url":"https://bugzilla.suse.com/1259921","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-3029","title":"CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T15:53:38.778Z","modified":"2026-07-15T01:10:04.355Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-13117","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T15:53:38Z","modified":"2026-07-15T01:10:04Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:55.842782Z"}],"ghsa":[{"id":"GHSA-cxqh-p2w9-fmr7","title":"PyMuPDF has a path traversal in _main_.py","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T18:31:18Z","modified":"2026-03-19T19:37:55Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:38.524712Z"}],"nvd":[{"id":"CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T16:16:04.297Z","modified":"2026-07-15T02:20:55.83Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-3029","title":"CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T15:53:38.778Z","modified":"2026-10-28T02:30:25.114936557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"DEBIAN-CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T16:16:04.297Z","modified":"2026-10-01T03:03:21.90894945Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-cxqh-p2w9-fmr7","title":"PyMuPDF has a path traversal in _main_.py","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T18:31:18Z","modified":"2026-07-13T16:43:14.919416502Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"PYSEC-2026-3001","title":"PyMuPDF has a path traversal in _main_.py","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-07-13T14:36:43.974708Z","modified":"2026-07-13T16:33:07.802779002Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-3029","description":"A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","status":"published","published":"2026-03-19T16:16:00Z","modified":"2026-06-30T18:17:47.866958098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"openSUSE-SU-2026:10416-1","title":"python313-PyMuPDF-1.27.2.2-1.1 on GA media","description":"These are all security issues fixed in the python313-PyMuPDF-1.27.2.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-24T00:00:00Z","modified":"2026-03-25T08:31:17.184745Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20887-1","title":"Security update for python-PyMuPDF","description":"This update for python-PyMuPDF fixes the following issues:\n\nChanges in python-PyMuPDF:\n\n- CVE-2026-3029: Fixed path traversal and arbitrary file write via the\n  `embedded_get` function in `_main_.py` (bsc#1259921)\n","status":"published","published":"2026-06-02T09:04:33Z","modified":"2026-06-04T09:00:09.895075632Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}