Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-14T18:38:34 pymupdf: PyMuPDF: Arbitrary file write via path traversal vulnerability 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CWE-22

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

A flaw was found in PyMuPDF. This path traversal vulnerability exists in the `extract_objects()` function, specifically within the font branch. A remote attacker can exploit this by providing a specially crafted PDF, EPUB, XPS, or FB2 file. The vulnerability allows the attacker to use encoded path separators in the BaseFont name, leading to arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-82035 https://nvd.nist.gov/vuln/detail/CVE-2026-82035 https://github.com/pymupdf/PyMuPDF/commit/b2c8f3a859fed35c379a44df566f770dc3e18605 https://www.vulncheck.com/advisories/pymupdf-path-traversal-via-extract-objects-font-branch