Executive brief
PyMuPDF is a popular Python library used for processing and manipulating PDF documents. A security flaw in its file extraction tool allows a specially crafted PDF to write files to unintended locations on a user's computer. This could allow an attacker to overwrite critical system files or disrupt services if the library is run with high-level permissions.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'embedded_get' function within PyMuPDF's '__main__.py'. When the 'embed-extract' command is used without a specified output path ('args.output'), the utility relies on untrusted metadata from the embedded file within the PDF to determine the destination filename. Because this metadata is opened in write-binary mode without validation, a crafted PDF can specify a path (e.g., using '../' sequences) to write files outside the intended directory. This can lead to arbitrary file overwrites on the local filesystem. The issue is fixed in version 1.26.7.
Affected products
- Artifex Software Inc. PyMuPDF 1.26.5
Timeline
- 2025-11-19: other: Vendor notified
- 2026-02-12: disclosed: Initial public release of vulnerability note
- 2026-03-19: advisory: NVD publication and CVE assignment
- 2026-03-19: patched: Fix identified in version 1.26.7 via commit 603cafe
References
- http://github.com/pymupdf/PyMuPDF
- http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a
- https://www.kb.cert.org/vuls/id/504749
- https://access.redhat.com/security/cve/CVE-2026-3029
- https://bugzilla.redhat.com/show_bug.cgi?id=2449054
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3029.json