CVE-2026-23907 - Vulnerability Analysis

Overview

Apache PDFBox ExtractEmbeddedFiles example 2.0.24 through 2.0.35 and 3.0.0 through 3.0.6 contains a path traversal caused by appending filenames from PDComplexFileSpecification.getFilename() to extraction paths, letting attackers write files outside intended directories, exploit requires crafted file input.

Severity & Score

Impact

Attackers can write files outside intended directories, potentially overwriting critical files or executing arbitrary code.

Mitigation

Update to a version later than 2.0.35 or 3.0.6 where the extraction path is properly validated.

References

• https://github.com/JoakimBulow/
• https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw
• http://www.openwall.com/lists/oss-security/2026/03/10/1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner