Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Published Mar 10, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.89%
Description
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
Affected products
-
- Version 2.0.24StatusaffectedConstraints<=2.0.35
- Version 3.0.0StatusaffectedConstraints<=3.0.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache PDFBox Examples | unaffected |
|
- ≥ 2.0.24 · ≤ 2.0.36
- ≥ 3.0.0 · ≤ 3.0.7
No data.
Red Hat AMQ Broker 7
pdfbox
Fix deferred
Red Hat Data Grid 8
pdfbox
Fix deferred
Red Hat Fuse 7
pdfbox
Fix deferred
Red Hat Fuse 7
pdfbox-tools
Fix deferred
Red Hat JBoss Enterprise Application Platform 7
pdfbox
Fix deferred
Red Hat JBoss Enterprise Application Platform 7
pdfbox-tools
Fix deferred
Red Hat JBoss Enterprise Application Platform 8
pdfbox
Fix deferred
Red Hat JBoss Enterprise Application Platform 8
pdfbox-io
Fix deferred
Red Hat JBoss Enterprise Application Platform 8
pdfbox-tools
Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack
pdfbox
Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack
pdfbox-io
Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack
pdfbox-tools
Fix deferred
Red Hat build of Apache Camel for Spring Boot 4
pdfbox
Fix deferred
Red Hat build of Apache Camel for Spring Boot 4
pdfbox-io
Fix deferred
Red Hat build of Apache Camel for Spring Boot 4
pdfbox-tools
Fix deferred
streams for Apache Kafka 2
pdfbox
Fix deferred
streams for Apache Kafka 3
pdfbox
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat AMQ Broker 7 | pdfbox | Fix deferred | n/a |
| Red Hat Data Grid 8 | pdfbox | Fix deferred | n/a |
| Red Hat Fuse 7 | pdfbox | Fix deferred | n/a |
| Red Hat Fuse 7 | pdfbox-tools | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | pdfbox | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | pdfbox-tools | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | pdfbox | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | pdfbox-io | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | pdfbox-tools | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | pdfbox | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | pdfbox-io | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | pdfbox-tools | Fix deferred | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox | Fix deferred | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox-io | Fix deferred | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox-tools | Fix deferred | n/a |
| streams for Apache Kafka 2 | pdfbox | Fix deferred | n/a |
| streams for Apache Kafka 3 | pdfbox | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security rates this issue as Moderate severity, because the vulnerable code exists in the example implementation shipped with Apache PDFBox and is not part of the core library functionality. Applications that copied or reused the ExtractEmbeddedFiles example code without adding proper path validation may allow path traversal during extraction of embedded files from PDF documents. The impact is limited to the permissions of the application processing the PDF. Systems that do not use this example code or that properly sanitize extraction paths are not affected.
Red Hat mitigation
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.
References (9)
- http://www.openwall.com/lists/oss-security/2026/03/10/1 Mailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-23907 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445994 Issue Tracking
- https://github.com/JoakimBulow/ Not Applicable
- https://github.com/advisories/GHSA-jjwr-xmw6-gf78 Advisory
- https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7
- https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw vendor-advisoryMailing ListVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-23907
- https://www.cve.org/CVERecord?id=CVE-2026-23907
| Link | Providers | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/03/10/1 | Mailing ListThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2026-23907 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2445994 | Issue Tracking | |
| https://github.com/JoakimBulow/ | Not Applicable | |
| https://github.com/advisories/GHSA-jjwr-xmw6-gf78 | Advisory | |
| https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7 | ||
| https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw | vendor-advisoryMailing ListVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-23907 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-23907 |
Change history (0)
No recorded changes yet.