Read the docs
TI-2026-26280 Aliases CVE-2026-33929GHSA-gcj8-76p4-g2fq

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00711 53rd percentileScored 2026-11-07
Fix Partial org.apache.pdfbox:pdfbox-examples (Maven): 2.0.37, 3.0.8Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache PDFBox Examples2.0.24 – 2.0.36; 3.0.0 – 3.0.7—No fix listedCNA
—org.apache.pdfbox:pdfbox-examples (Maven)2.0.24 to before 2.0.372.0.37Patch availableGHSA-gcj8-76p4-g2fq
—org.apache.pdfbox:pdfbox-examples (Maven)3.0.0 to before 3.0.83.0.8Patch availableGHSA-gcj8-76p4-g2fq
  • Apache PDFBox Examples VendorApache Affected 2.0.24 – 2.0.36; 3.0.0 – 3.0.7 Fixed in — No fix listed CNA
  • org.apache.pdfbox:pdfbox-examples (Maven) Vendor— Affected 2.0.24 to before 2.0.37 Fixed in 2.0.37 Patch available GHSA-gcj8-76p4-g2fq
  • org.apache.pdfbox:pdfbox-examples (Maven) Vendor— Affected 3.0.0 to before 3.0.8 Fixed in 3.0.8 Patch available GHSA-gcj8-76p4-g2fq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*2.0.24 to before 2.0.37; 3.0.0 to before 3.0.8VulnerableApache
  • cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* Versions 2.0.24 to before 2.0.37; 3.0.0 to before 3.0.8 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gcj8-76p4-g2fq org.apache.pdfbox:pdfbox-examples (Maven) Fixed in 2.0.37 Advisory →
  • Fix · GHSA-gcj8-76p4-g2fq org.apache.pdfbox:pdfbox-examples (Maven) Fixed in 3.0.8 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Not affected: 2 products
  • Red Hat AMQ Broker 7
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33929
  2. 2026-10-03 Alias added: GHSA-gcj8-76p4-g2fq

References

Patch 1

Advisory 2

Other 2

  • TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
  • TI-2016-01985 Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML… CVSS 3.0HIGH 7.8
  • TI-2018-05813 Infinite loop in Apache PDFBox CVSS 3.0MEDIUM 6.5
  • TI-2021-11808 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file CVSS 3.1MEDIUM 5.5
  • TI-2021-09241 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file CVSS 3.1MEDIUM 5.5
  • TI-2018-08451 Uncontrolled resource consumption in Apache PDFBox CVSS 3.1MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences