CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
Attackers can write arbitrary files outside the intended directory by supplying a crafted document with malicious font names to PyMuPDF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-82035?
CVE-2026-82035 is a high-severity path traversal vulnerability in PyMuPDF, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.
Weakness: CWE-22
Which versions are affected by CVE-2026-82035?
Linux distribution packages (2)
python-PyMuPDF openSUSE:Leap 16.0 | All versions | 1.21.1-lp160.6.1 |
python-PyMuPDF openSUSE:Tumbleweed | All versions | 1.28.2-1.1 |
How do I fix CVE-2026-82035?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82035 being exploited?
There is no known exploitation of CVE-2026-82035 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-82035, GHSA-434w-92hw-f2m3, UBUNTU-CVE-2026-82035, openSUSE-SU-2026:11824-1, openSUSE-SU-2026:21912-1.