CVE-2026-23907
Last modified
CVE-2026-23907 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. EPSS estimates a 0.89% chance of exploitation in the next 30 days.
Description
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Pdfbox | >= 2.0.24, <= 2.0.35 |
| Apache | Pdfbox | >= 3.0.0, <= 3.0.7 |
References
- https://github.com/JoakimBulow/Not Applicable
- https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffwMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/03/10/1Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-23907?
How severe is CVE-2026-23907?
How do I fix CVE-2026-23907?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-23900Various stored XSS vulnerabilities in the maps- and icon ren…6.5
- CVE-2026-23901Observable Timing Discrepancy vulnerability in Apache Shiro.…2.5
- CVE-2026-23902Incorrect Authorization vulnerability in Apache DolphinSched…8.1
- CVE-2026-23903Authentication Bypass by Alternate Name vulnerability in Apa…5.3
- CVE-2026-23904Kyuubi Engine UI proxy accepts a host and port from the requ…7.3
- CVE-2026-23906Affected Products and Versions * Apache Druid * Affect…9.8
- CVE-2026-23909Rejected reason: Not used
- CVE-2026-2391### Summary The `arrayLimit` option in qs does not enforce l…7.5
- CVE-2026-23910Rejected reason: Not used
- CVE-2026-23911Rejected reason: Not used
- CVE-2026-23912Rejected reason: Not used
- CVE-2026-23913Rejected reason: Not used
Are you affected by CVE-2026-23907?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST