PT-2026-32604 · Apache · Apache Pdfbox

Kaixuan Li · Published 2026-04-14 · Updated 2026-05-09 · CVE-2026-33929

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache PDFBox versions 2.0.24 through 2.0.36 Apache PDFBox versions 3.0.0 through 3.0.7

Description The ExtractEmbeddedFiles example contains a path traversal issue, which occurs when an application does not properly restrict the pathnames used to access files, potentially allowing access to directories outside the intended folder. A flaw in the path separator handling allows a malicious PDF to trigger write attempts to any path starting with the authorized directory prefix, such as writing to "/home/ABCDEF" when the user only has rights to "/home/ABC".

Recommendations Update versions 2.0.24 through 2.0.36 to version 2.0.37. Update versions 3.0.0 through 3.0.7 to version 3.0.8. Apply the fix provided in GitHub PR 427 for affected versions. Users who integrated the ExtractEmbeddedFiles example into production code should manually apply the updated changes from the project repository.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33929

GHSA-GCJ8-76P4-G2FQ

OESA-2026-2147

OESA-2026-2148

OESA-2026-2238

OESA-2026-2239

OESA-2026-2240

OPENSUSE-SU-2026:10550-1

Affected Products

Apache Pdfbox

References · 28

• https://github.com/apache/pdfbox/pull/427/changes · Patch
• https://osv.dev/vulnerability/OESA-2026-2239 · Vendor Advisory
• https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2240 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33929 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2148 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2238 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33929 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2147 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33929 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10550-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33929 · Security Note
• https://osv.dev/vulnerability/GHSA-gcj8-76p4-g2fq · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33929 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33929 · Vendor Advisory