{"id":"CVE-2026-23907","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-23907","generatedAt":"2026-10-28T02:10:21.457Z","title":"The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.","description":"This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted.","published":"2026-03-10T18:18:17.000Z","lastModified":"2026-09-17T17:22:10.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-22"],"affected":["apache/pdfbox-examples"],"epss":{"score":0.00901,"percentile":0.59447,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/JoakimBulow/","tags":["Not Applicable"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw","tags":["Mailing List","Vendor Advisory"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/03/10/1","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-23907","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}