Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-03-10T09:43:40 org.apache.pdfbox:pdfbox-examples: Apache PDFBox Example: Path Traversal via specially crafted filenames allows arbitrary file write 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-22

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

A path traversal vulnerability was identified in the ExtractEmbeddedFiles example provided with Apache PDFBox. The example code constructs extraction paths by directly appending filenames obtained from PDComplexFileSpecification.getFilename() without validating the resulting path. An attacker could exploit this behavior by embedding files in a PDF document with crafted filenames containing path traversal sequences. If the example code is reused in an application without modification, this could cause extracted files to be written outside the intended extraction directory, potentially leading to data corruption or unauthorized file creation.

Red Hat Product Security rates this issue as Moderate severity, because the vulnerable code exists in the example implementation shipped with Apache PDFBox and is not part of the core library functionality. Applications that copied or reused the ExtractEmbeddedFiles example code without adding proper path validation may allow path traversal during extraction of embedded files from PDF documents. The impact is limited to the permissions of the application processing the PDF. Systems that do not use this example code or that properly sanitize extraction paths are not affected. Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available. Red Hat AMQ Broker 7 Fix deferred pdfbox Red Hat build of Apache Camel for Spring Boot 4 Fix deferred pdfbox Red Hat build of Apache Camel for Spring Boot 4 Fix deferred pdfbox-io Red Hat build of Apache Camel for Spring Boot 4 Fix deferred pdfbox-tools Red Hat Data Grid 8 Fix deferred pdfbox Red Hat Fuse 7 Fix deferred pdfbox Red Hat Fuse 7 Fix deferred pdfbox-tools Red Hat JBoss Enterprise Application Platform 7 Fix deferred pdfbox Red Hat JBoss Enterprise Application Platform 7 Fix deferred pdfbox-tools Red Hat JBoss Enterprise Application Platform 8 Fix deferred pdfbox Red Hat JBoss Enterprise Application Platform 8 Fix deferred pdfbox-io Red Hat JBoss Enterprise Application Platform 8 Fix deferred pdfbox-tools Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pdfbox Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pdfbox-io Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pdfbox-tools streams for Apache Kafka 2 Fix deferred pdfbox streams for Apache Kafka 3 Fix deferred pdfbox https://www.cve.org/CVERecord?id=CVE-2026-23907 https://nvd.nist.gov/vuln/detail/CVE-2026-23907 https://github.com/JoakimBulow/ https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw