← Vulnerability feed

Vulnerability record · CVE-2026-33929 · published 14 April 2026

CVE-2026-33929: Apache pdfbox path traversal vulnerability

Apache · Pdfbox

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

4.3 CVSS 3.1 Medium EPSS 0.96% · top 40.0% CWE-22 · Path traversal
4.3CVSS 3.1 base score
0.96%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/pdfbox/pull/427/changes Patch
https://lists.apache.org/thread/j8l07tgzy9dm8d8n0f3c45h7zg7t3ld6 Mailing ListVendor Advisory
https://lists.apache.org/thread/op3lyx1ngzy4qycn06l6hljyf28ff0zs Mailing List

Track CVE-2026-33929 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-0228Apache pdfbox xml external entity (xxe) vulnerabilityApache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attac…EPSS 9.5%7.8CVE-2016-2175Apache pdfbox vulnerabilityApache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XM…EPSS 3.8%6.5CVE-2018-8036Apache pdfbox vulnerabilityIn Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of m…EPSS 4.6%5.5CVE-2021-31811Apache pdfbox allocation without limits vulnerabilityIn Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version …EPSS 3.4%5.5CVE-2021-31812Apache pdfbox vulnerabilityIn Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 a…EPSS 3.1%5.5CVE-2021-27807Apache pdfbox vulnerabilityA carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x ver…EPSS 3.0%5.5CVE-2021-27906Apache pdfbox vulnerabilityA carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2…EPSS 3.3%5.5CVE-2018-11797Apache pdfbox vulnerabilityIn Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing …EPSS 3.5%

Source: NIST National Vulnerability Database (record CVE-2026-33929), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.