Executive brief
Apache PDFBox is a popular Java library for creating and manipulating PDF documents. The ExtractEmbeddedFiles example code contains a path traversal vulnerability that allows an attacker to write extracted files outside the intended directory when processing a malicious PDF. Organizations that have copied this example into production code could have their systems exposed to arbitrary file writes.
Technical details
A path traversal vulnerability (CWE-22) exists in the ExtractEmbeddedFiles example code in Apache PDFBox. The vulnerability occurs because filenames obtained from PDComplexFileSpecification.getFilename() are directly appended to the extraction path without validation. An attacker can craft a PDF with embedded files containing path traversal sequences (e.g., "../../../") in the filename to write files outside the intended extraction directory. The attack requires the victim to process a malicious PDF file with the vulnerable example code. Apache has patched the example by implementing canonical path conversion and verification to ensure extracted paths remain within the intended directory.
Affected products
- Apache PDFBox 2.0.24 through 2.0.35, 3.0.0 through 3.0.6
Timeline
- 2026-03-10: disclosed