Executive brief
A vulnerability exists in the example code provided with Apache PDFBox, a library used for processing PDF documents. If developers have integrated the 'ExtractEmbeddedFiles' example into their own applications, an attacker could use a specially crafted PDF to write files to unauthorized locations on the server. This could lead to data corruption or the overwriting of sensitive files in directories adjacent to the intended storage path.
Technical details
A path traversal vulnerability (CWE-22) exists in the ExtractEmbeddedFiles example of Apache PDFBox. While a previous fix attempted to validate that extracted files remained within a target directory using startsWith(), it failed to account for file path separators. An attacker with low privileges can provide a malicious PDF that causes the application to write files to paths that share a prefix with the intended directory (e.g., writing to /home/ABCDEF when the intended path was /home/ABC). This affects users who have integrated the example code into production environments. Patches are available in versions 2.0.37 and 3.0.8.
Affected products
- Apache PDFBox Examples 2.0.24 through 2.0.36, 3.0.0 through 3.0.7
Timeline
- 2026-04-14: advisory: GitHub Advisory GHSA-gcj8-76p4-g2fq published
- 2026-04-14: disclosed: CVE-2026-33929 disclosed