CVE-2026-3029: PyMuPDF Path Traversal and Arbitrary File Write Vulnerability
Summary
CVE-2026-3029: PyMuPDF has a path traversal in _main_.py. Affects pymupdf versions >= 1.26.5, < 1.26.7. Fixed in 1.26.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyMuPDF is a popular open-source library for working with PDF documents and other document formats. It allows users to create, manipulate, and extract information from PDFs with ease. The library is widely used in various applications due to its efficiency and rich feature set. However, a recent vulnerability has been identified in version 1.26.5, which could potentially allow malicious actors to exploit the library for unauthorized file access and manipulation.
Vulnerability Detail
A path traversal and arbitrary file write vulnerability exists in the embedded get function within 'main.py' of PyMuPDF version 1.26.5. This vulnerability allows attackers to craft requests that can write files to arbitrary locations on the server, leading to potential data breaches or unauthorized file modifications. The issue arises from improper validation of user input, which can be exploited to traverse the file system and access sensitive files.
How To Fix
Minimum fixed version
1.26.7
This is the first release that contains the fix.
pip install --upgrade "pymupdf==1.26.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to restrict file paths and prevent traversal attacks. Ensure that user inputs are sanitized and validated against a whitelist of acceptable paths.
Conclusion
The identified vulnerability in PyMuPDF poses significant risks related to unauthorized file access and manipulation. It is crucial for users of the library to update to the latest version to ensure their applications remain secure. Additionally, implementing proper input validation can help mitigate potential risks until an update can be applied.
See every vulnerability recorded for pymupdf →
FAQ
The vulnerability is a path traversal and arbitrary file write issue that allows unauthorized file access and manipulation.
The vulnerability affects PyMuPDF version 1.26.5. Versions 1.26.7 and later have the issue fixed.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of severity.
If an immediate update is not possible, implement strict input validation to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pymupdf.
