CVE-2026-23907: Apache PDFBox Path Traversal Vulnerability in pdfbox-examples
Summary
CVE-2026-23907: Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function. Affects org.apache.pdfbox:pdfbox-examples versions >= 2.0.24, < 3.0.7. Fixed in 3.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is a powerful Java library used for creating, manipulating, and extracting data from PDF documents. It provides various functionalities, including the ability to extract embedded files from PDFs. The pdfbox-examples package offers sample code to demonstrate these capabilities. However, certain versions of this package are vulnerable to a path traversal issue, which can lead to unauthorized file access.
Vulnerability Detail
The vulnerability arises from the ExtractEmbeddedFiles example in Apache PDFBox, specifically in the PDComplexFileSpecification.getFilename() function. This function retrieves a filename that is then appended to an extraction path without proper validation. As a result, an attacker could exploit this flaw by crafting a malicious PDF that includes a filename with path traversal sequences, allowing them to extract files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.
How To Fix
Minimum fixed version
3.0.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, users should manually validate the extraction path in their implementation of the ExtractEmbeddedFiles example. Ensure that the filename obtained from PDComplexFileSpecification.getFilename() does not contain any path traversal sequences (e.g., '../') before appending it to the extraction path.
Conclusion
The CVE-2026-23907 vulnerability in Apache PDFBox's pdfbox-examples package poses a risk of unauthorized file access due to path traversal. Users are advised to update to version 3.0.7 or later to mitigate this risk. Additionally, manual validation of file paths can serve as a temporary workaround.
See every vulnerability recorded for org.apache.pdfbox:pdfbox-examples →
FAQ
A path traversal vulnerability allows an attacker to access files and directories stored outside the intended directory by manipulating file paths.
The vulnerability affects Apache PDFBox versions from 2.0.24 through 2.0.35 and from 3.0.0 through 3.0.6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your pom.xml file to the Vulert playground to check for vulnerabilities.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package, implement a manual check to validate the extraction path and ensure it does not allow path traversal.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox-examples.
