Junglewise Threat Intelligence

CVE-2026-3029: Artifex PyMuPDF path traversal in embedded_get function

CVE-2026-3029 · Severity: high · CVSS 7.5 · Published 2026-03-19

Vendors: Artifex Software, PyPI.

Executive brief

PyMuPDF is a popular Python library used for processing and manipulating PDF documents. A security flaw in its file extraction tool allows a specially crafted PDF to write files to unintended locations on a user's computer. This could allow an attacker to overwrite critical system files or disrupt services if the library is run with high-level permissions.

Technical details

A path traversal vulnerability (CWE-22) exists in the 'embedded_get' function within PyMuPDF's '__main__.py'. When the 'embed-extract' command is used without a specified output path ('args.output'), the utility relies on untrusted metadata from the embedded file within the PDF to determine the destination filename. Because this metadata is opened in write-binary mode without validation, a crafted PDF can specify a path (e.g., using '../' sequences) to write files outside the intended directory. This can lead to arbitrary file overwrites on the local filesystem. The issue is fixed in version 1.26.7.

Affected products

  • Artifex Software Inc. PyMuPDF 1.26.5

Timeline

  • 2025-11-19: other: Vendor notified
  • 2026-02-12: disclosed: Initial public release of vulnerability note
  • 2026-03-19: advisory: NVD publication and CVE assignment
  • 2026-03-19: patched: Fix identified in version 1.26.7 via commit 603cafe

References