---
cve: "CVE-2026-23907"
severity: "MEDIUM"
cvss: 5.3
epss: "89%"
vendor: "Apache Software Foundation"
kev: false
exploited: false
published: "2026-03-10 18:18:16"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-11T12:20:29+02:00"
---

# CVE-2026-23907

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

This issue affects the 
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.


The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because 
the filename that is obtained from 
PDComplexFileSpecification.getFilename() is appended to the extraction path.

Users who have copied this example into their production code should 
review it to ensure that the extraction path is acceptable. The example 
has been changed accordingly, now the initial path and the extraction 
paths are converted into canonical paths and it is verified that 
extraction path contains the initial path. The documentation has also 
been adjusted.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

## Angriffsmuster (CAPEC)

- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_

## Referenzen

- <https://github.com/JoakimBulow/>
- <https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw>
- <http://www.openwall.com/lists/oss-security/2026/03/10/1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-23907) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_