https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:41:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-33929 <p><strong>Affected:</strong> Apache Software Foundation Apache PDFBox Examples</p> <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in Apache PDFBox Examples.</p> <p>This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.</p> <p>Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.</p> <p>The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn&#39;t consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. &#34;/home/ABCDEF&#34;.</p> <p>Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache PDFBox Examples</p> <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in Apache PDFBox Examples.</p> <p>This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.</p> <p>Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.</p> <p>The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn&#39;t consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. &#34;/home/ABCDEF&#34;.</p> <p>Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.</p> https://vulnerability.circl.lu/vuln/cve-2026-33929