CVE-2026-33929: Apache PDFBox Examples Path Traversal Vulnerability in ExtractEmbeddedFiles
Summary
CVE-2026-33929: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code. Affects org.apache.pdfbox:pdfbox-examples across 2 version ranges.
>= 2.0.24, < 2.0.37
>= 3.0.0, < 3.0.8
Fixed in 2.0.37 or 3.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is a popular open-source library used for creating and manipulating PDF documents in Java. It provides a range of functionalities, including the ability to extract text, images, and embedded files from PDFs. The ExtractEmbeddedFiles example is a part of the PDFBox examples that demonstrates how to extract embedded files from a PDF document. However, this example has been found to contain a vulnerability that could allow unauthorized file access.
Vulnerability Detail
The vulnerability is classified as a Path Traversal issue (CWE-22), which allows an attacker to manipulate file paths to access files outside of the intended directory. In this case, the ExtractEmbeddedFiles example does not properly validate the file path separator, leading to a situation where a malicious PDF could cause the application to attempt writing to arbitrary paths. This could potentially allow an attacker to overwrite or create files in sensitive directories, posing a significant security risk.
How To Fix
Latest published version: 3.0.7 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.24, < 2.0.372.0.37 -
>= 3.0.0, < 3.0.83.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, users who have copied the ExtractEmbeddedFiles example into their production code should apply the fix provided in GitHub PR 427. This involves modifying the code to ensure proper validation of file paths to prevent path traversal attacks. Ensure that the file paths are sanitized and validated before any file operations are performed.
Conclusion
The Apache PDFBox Examples vulnerability (CVE-2026-33929) highlights a significant security risk due to improper path validation in the ExtractEmbeddedFiles example. Users are urged to update to the latest versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.apache.pdfbox:pdfbox-examples →
FAQ
The vulnerability is a Path Traversal issue that allows unauthorized access to files outside the intended directory.
The vulnerability affects Apache PDFBox versions from 2.0.24 to 2.0.36 and from 3.0.0 to 3.0.7.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If you cannot update immediately, apply the fix from GitHub PR 427 to sanitize and validate file paths in your code.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox-examples.
