{"schemaVersion":3,"id":"CVE-2026-23907","aliases":["UBUNTU-CVE-2026-23907","DEBIAN-CVE-2026-23907","GHSA-jjwr-xmw6-gf78"],"status":"published","duplicateOf":null,"title":null,"description":"This issue affects the\nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because\nthe filename that is obtained from\nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should\nreview it to ensure that the extraction path is acceptable. The example\nhas been changed accordingly, now the initial path and the extraction\npaths are converted into canonical paths and it is verified that\nextraction path contains the initial path. The documentation has also\nbeen adjusted.","dates":{"published":"2026-03-10T09:43:40.384Z","modified":"2026-03-10T17:51:53.261Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00901,"percentile":0.59044,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.015000000000000083,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00886},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00901,"percentile":0.59044}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00886,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00901,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00901,"percentile":0.59044}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"apache software foundation","product":"apache pdfbox examples","name":"Apache PDFBox Examples","label":"apache pdfbox examples","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.24, ≤ 2.0.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, ≤ 3.0.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.24, ≤ 2.0.35 | ≥ 3.0.0, ≤ 3.0.6","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_pdfbox_examples"},{"vendor":"apache","product":"pdfbox-examples","name":"pdfbox-examples","label":"pdfbox-examples","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.24, ≤ 2.0.36","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, ≤ 3.0.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.24, ≤ 2.0.36 | ≥ 3.0.0, ≤ 3.0.7","eol":null,"hubHref":"/vendor/apache/pdfbox-examples"},{"vendor":"debian","product":"libpdfbox-java","name":"libpdfbox-java","label":"libpdfbox-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libpdfbox-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"debian","product":"libpdfbox2-java","name":"libpdfbox2-java","label":"libpdfbox2-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libpdfbox2-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libpdfbox-java","name":"libpdfbox-java","label":"libpdfbox-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libpdfbox-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libpdfbox2-java","name":"libpdfbox2-java","label":"libpdfbox2-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libpdfbox2-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.apache.pdfbox","product":"pdfbox-examples","name":"org.apache.pdfbox:pdfbox-examples","label":"pdfbox-examples","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.pdfbox/pdfbox-examples","purlType":"maven","versions":[{"text":"≥ 2.0.24, < 3.0.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.24, < 3.0.7","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/JoakimBulow/","label":"github.com/JoakimBulow/","hostname":"github.com","tags":["Not Applicable"]},{"url":"https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw","label":"lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw","hostname":"lists.apache.org","tags":["Vendor Advisory","WEB","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/10/1","label":"www.openwall.com/lists/oss-security/2026/03/10/1","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-23907","label":"ubuntu.com/security/CVE-2026-23907","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23907","label":"www.cve.org/CVERecord?id=CVE-2026-23907","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23907","label":"security-tracker.debian.org/tracker/CVE-2026-23907","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23907","label":"nvd.nist.gov/vuln/detail/CVE-2026-23907","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7","label":"github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/pdfbox","label":"github.com/apache/pdfbox","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-03-10T09:43:40.384Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-10T17:51:53.261Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:03:13.883Z","stale":false,"partial":false}}