THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-23907 (MEDIUM 5.3) — This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification

[NVD] CVE-2026-23907 (MEDIUM 5.3) — This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification

lownvdPublished 2026-03-10

CVE-2026-23907 CVSS: 5.3 MEDIUM Published: 2026-03-10T18:18:16.960

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.

The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.

Indicators of compromise

CVE-2026-23907cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-23907