CVE-2026-23907: Pdfbox examples Path Traversal Vulnerability

MODERATE
Advisory Identifier: GHSA-jjwr-xmw6-gf78
Share
CVSS 5.3
CWE-22
Published
Advisory Summary

CVE-2026-23907 is a MODERATE (CVSS 5.3) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Pdfbox examples libraries in the Maven ecosystem. The issue involves apache pdfbox has path traversal through pdcomplexfilespecification.getfilename() function. Remediation is available by upgrading affected packages to version 3.0.7.

CVE-2026-23907 at a Glance

CVE Identifier CVE-2026-23907
GHSA Identifier GHSA-jjwr-xmw6-gf78
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Pdfbox examples
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2026-23907

To remediate this vulnerability, upgrade all affected Pdfbox examples dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.pdfbox:pdfbox-examples fixed: 3.0.7 
<dependency>
    <groupId>org.apache.pdfbox</groupId>
    <artifactId>pdfbox-examples</artifactId>
    <version>3.0.7</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apache.pdfbox

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-23907, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.pdfbox

Analyze the terminal output to locate any version of Pdfbox examples in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.7), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.pdfbox command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Pdfbox examples, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

CVE-2026-23907 Affected Pdfbox examples Versions

1 component(s)
Fixed Versions:
3.0.7
Product / Package Ecosystem Affected Versions Fixed Version
org.apache.pdfbox:pdfbox-examples
maven/org.apache.pdfbox/pdfbox-examples
Maven
≥ 2.0.24
< 3.0.7
3.0.7

References

NVD — CVE-2026-23907 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23907
Security Fix Commit FIX COMMIT
https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7
Pdfbox examples Source Repository REPOSITORY
https://github.com/apache/pdfbox
lists.apache.org/thread/gyfq5tcrxfv7... WEB
https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw
Pdfbox examples Security Information SECURITY
http://www.openwall.com/lists/oss-security/2026/03/10/1

Frequently Asked Questions

What is CVE-2026-23907?
CVE-2026-23907 is a security vulnerability in Pdfbox examples involving Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Pdfbox examples versions are affected?
Affected versions include releases prior to 3.0.7 across affected packages: org.apache.pdfbox:pdfbox-examples.
What version fixes CVE-2026-23907?
Upgrading to 3.0.7 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pdfbox-examples affected?
Yes, org.apache.pdfbox:pdfbox-examples is affected in releases prior to 3.0.7. Upgrade your dependency to 3.0.7 or later.
What is the CVSS score of CVE-2026-23907?
CVE-2026-23907 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2026-23907?
CVE-2026-23907 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Maven dependencies for CVE-2026-23907?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.pdfbox'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jjwr-xmw6-gf78",
  "modified" : "2026-03-11T18:13:49Z",
  "published" : "2026-03-10T18:31:19Z",
  "aliases" : [ "CVE-2026-23907" ],
  "summary" : "Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function",
  "details" : "This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.pdfbox:pdfbox-examples"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.24"
      }, {
        "fixed" : "3.0.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23907"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/pdfbox/commit/b028eafdf101b58e4ee95430c3be25e3e3aa29d7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/pdfbox"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2026/03/10/1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-11T18:13:49Z",
    "nvd_published_at" : "2026-03-10T18:18:16Z"
  }
}