Read the docs
TI-2026-19262 Aliases CVE-2026-23907GHSA-jjwr-xmw6-gf78

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0099 62nd percentileScored 2026-11-07
Fix Partial org.apache.pdfbox:pdfbox-examples (Maven): 3.0.7Red Hat: 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache PDFBox Examples2.0.24 – 2.0.35; 3.0.0 – 3.0.6—No fix listedCNA
—org.apache.pdfbox:pdfbox-examples (Maven)2.0.24 to before 3.0.73.0.7Patch availableGHSA-jjwr-xmw6-gf78
  • Apache PDFBox Examples VendorApache Affected 2.0.24 – 2.0.35; 3.0.0 – 3.0.6 Fixed in — No fix listed CNA
  • org.apache.pdfbox:pdfbox-examples (Maven) Vendor— Affected 2.0.24 to before 3.0.7 Fixed in 3.0.7 Patch available GHSA-jjwr-xmw6-gf78

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:*2.0.24 – 2.0.36; 3.0.0 – 3.0.7VulnerableApache
  • cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:* Versions 2.0.24 – 2.0.36; 3.0.0 – 3.0.7 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jjwr-xmw6-gf78 org.apache.pdfbox:pdfbox-examples (Maven) Fixed in 3.0.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
streams for Apache Kafka 2AffectedNo fix yet: Fix deferred
streams for Apache Kafka 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23907
  2. 2026-10-03 Alias added: GHSA-jjwr-xmw6-gf78

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences