Is CVE-2026-3029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3029 being exploited in the wild.

How severe is CVE-2026-3029?

High severity, with a CVSS score of 7.5, published 19 March 2026.

Which products and versions are affected?

Artifex Software PyMuPDF 1.26.5; pymupdf (PyPI) ECOSYSTEM:introduced=1.26.5,fixed=1.26.7.

Is there a fix for CVE-2026-3029?

Yes. pymupdf (PyPI): upgrade to 1.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3029 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3029?

Check whether you run Artifex Software PyMuPDF or pymupdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3029: Artifex PyMuPDF path traversal in embedded_get function

CVE-2026-3029 · Severity: high · CVSS 7.5 · Published 2026-03-19

PyMuPDF is a popular Python library used for processing and manipulating PDF documents. A security flaw in its file extraction tool allows a specially crafted PDF to write files to unintended locations on a user's computer. This could allow an attacker to overwrite critical system files or disrupt services if the library is run with high-level permissions.

Vendors: Artifex Software, PyPI.

Quick answers

Is CVE-2026-3029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3029 being exploited in the wild.
How severe is CVE-2026-3029?: High severity, with a CVSS score of 7.5, published 19 March 2026.
Which products and versions are affected?: Artifex Software PyMuPDF 1.26.5; pymupdf (PyPI) ECOSYSTEM:introduced=1.26.5,fixed=1.26.7.
Is there a fix for CVE-2026-3029?: Yes. pymupdf (PyPI): upgrade to 1.26.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3029 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3029?: Check whether you run Artifex Software PyMuPDF or pymupdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pymupdf (PyPI): upgrade to 1.26.7 or later
```
pip install "pymupdf>=1.26.7"
```

Technical details

A path traversal vulnerability (CWE-22) exists in the 'embedded_get' function within PyMuPDF's '__main__.py'. When the 'embed-extract' command is used without a specified output path ('args.output'), the utility relies on untrusted metadata from the embedded file within the PDF to determine the destination filename. Because this metadata is opened in write-binary mode without validation, a crafted PDF can specify a path (e.g., using '../' sequences) to write files outside the intended directory. This can lead to arbitrary file overwrites on the local filesystem. The issue is fixed in version 1.26.7.

Affected products

Artifex Software Inc. PyMuPDF 1.26.5

Identifiers

CVE-2026-3029
GHSA-cxqh-p2w9-fmr7
PYSEC-2026-3001

Timeline

2025-11-19: other: Vendor notified
2026-02-12: disclosed: Initial public release of vulnerability note
2026-03-19: advisory: NVD publication and CVE assignment
2026-03-19: patched: Fix identified in version 1.26.7 via commit 603cafe

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.