CVE-2026-33929 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
A path traversal flaw in the ExtractEmbeddedFiles example allows attackers to write files to unintended directories via malicious PDFs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33929?
CVE-2026-33929 is a medium-severity path traversal vulnerability in Apache PDFBox Examples, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.
Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.
The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".
Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.
Weakness: CWE-22
Which versions are affected by CVE-2026-33929?
4 open source packages ship an affected version, including org.apache.pdfbox:pdfbox-examples. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.pdfbox:pdfbox-examples Maven | From 2.0.24 | 2.0.37 |
org.apache.pdfbox:pdfbox-examples Maven | From 2.0.24 | 2.0.37 |
org.apache.pdfbox:pdfbox-examples Maven | From 3.0.0 | 3.0.8 |
org.apache.pdfbox:pdfbox-examples Maven | From 3.0.0 | 3.0.8 |
Products include Apache Pdfbox.
How do I fix CVE-2026-33929?
Upgrade org.apache.pdfbox:pdfbox-examples to a fixed version for your release line: 2.0.37 or 3.0.8.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33929 being exploited?
There is no known exploitation of CVE-2026-33929 in the wild and no public exploit code.
Other vulnerabilities in Apache PDFBox Examples
- CVE-2016-2175 High severity vulnerability that affects org.apache.pdfbox:pdfbox
- CVE-2018-8036 Loop with Unreachable Exit Condition in Apache PDFBox
- CVE-2021-31811 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
- CVE-2021-31812 A carefully crafted PDF file can trigger an infinite loop while loading the file
- CVE-2021-27807 A carefully crafted PDF file can trigger an infinite loop while loading the file
Sources
Also known as DEBIAN-CVE-2026-33929, GHSA-gcj8-76p4-g2fq, OESA-2026-2147, OESA-2026-2148, OESA-2026-2238, OESA-2026-2239 and 2 more.