{"cve":"CVE-2026-23907","nvd":{"published":"2026-03-10T18:18:16.960","modified":"2026-09-17T17:22:10.357","status":"Analyzed","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-22"],"references":["https://github.com/JoakimBulow/","https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw","http://www.openwall.com/lists/oss-security/2026/03/10/1"],"products":["apache:pdfbox-examples"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-23907","score":0.00901,"percentile":0.59716,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-jjwr-xmw6-gf78","url":"https://osv.dev/vulnerability/GHSA-jjwr-xmw6-gf78","summary":"Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function","modified":"2026-09-10T03:50:39.838609463Z","packages":[{"ecosystem":"Maven","name":"org.apache.pdfbox:pdfbox-examples","purl":"pkg:maven/org.apache.pdfbox/pdfbox-examples","ranges":[">=2.0.24 <3.0.7"],"fixed":["3.0.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}