CVE-2026-23907: 
Java vulnerability analysis and mitigation

CVE-2026-23907 is a path traversal vulnerability (CWE-22) in the ExtractEmbeddedFiles example code of Apache PDFBox. The flaw exists because the filename obtained from PDComplexFileSpecification.getFilename() is appended directly to the extraction path without sanitization, allowing files to be written to arbitrary filesystem locations. Affected versions include Apache PDFBox Examples (org.apache.pdfbox:pdfbox-examples) 2.0.24 through 2.0.36 and 3.0.0 through 3.0.7. It was disclosed on March 10, 2026, by Joakim Bülow of the Neo4j Security Team and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, Openwall OSS-Sec).

The root cause is improper path validation (CWE-22) in the ExtractEmbeddedFiles example: the code calls PDComplexFileSpecification.getFilename() to retrieve an embedded file's name from a PDF and concatenates it directly onto the target extraction directory path without canonicalization or boundary checks. An attacker can craft a malicious PDF embedding a file with a path-traversal sequence (e.g., ../../etc/cron.d/malicious) as its filename, causing the extraction to write outside the intended directory. The vulnerability specifically affects applications that have copied this example code into production — it is not a flaw in the core PDFBox library itself. The fix converts both the initial path and the extraction path to canonical forms and verifies the extraction path is contained within the initial path (Openwall OSS-Sec, Red Hat Bugzilla). Public PoC code (Java, Python, and shell scripts) is available demonstrating arbitrary file write (GitHub PoC).

Successful exploitation allows an unauthenticated attacker to write files to arbitrary locations on the filesystem by supplying a specially crafted PDF with malicious embedded filenames. This can result in overwriting sensitive system files, planting web shells or scripts in web-accessible directories, or injecting malicious content into cron jobs or startup scripts — potentially escalating to remote code execution. The confidentiality impact is limited (low), but the integrity impact can be severe if the attacker can place executable code in a privileged location (Red Hat Advisory, Red Hat Bugzilla).

A public proof-of-concept is available on GitHub, comprising TestPathTraversal.java, create_malicious_pdf.py, and test_path_traversal.sh, which together demonstrate the arbitrary file write capability without requiring interaction with an external deployment (GitHub PoC). The vulnerability is exploitable by unauthenticated attackers with no privileges required and no user interaction needed. The EPSS score is approximately 0.021% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure. Nessus detection plugin 301969 is available for scanning (Red Hat Advisory).

1. Craft a malicious PDF: Use the provided create_malicious_pdf.py PoC script to generate a PDF containing an embedded file whose filename includes path traversal sequences (e.g., ../../target/directory/malicious_file). This abuses the PDF embedded file specification to set a crafted filename.
2. Deliver the PDF: Submit the malicious PDF to any application that uses the ExtractEmbeddedFiles example code from Apache PDFBox in production (e.g., via file upload, email attachment processing, or document ingestion pipeline).
3. Trigger extraction: The vulnerable application calls PDComplexFileSpecification.getFilename() and appends the attacker-controlled filename to the extraction directory path without validation, causing the embedded file content to be written to the traversed path.
4. Achieve arbitrary file write: The attacker's chosen file (e.g., a web shell, cron job, or SSH authorized_keys entry) is written to the target location outside the intended extraction directory.
5. Escalate to code execution (if applicable): If the written file is placed in an executable location (e.g., a web-accessible directory or cron path), the attacker can trigger its execution to achieve remote code execution (GitHub PoC, Openwall OSS-Sec).

• File System: Unexpected files appearing outside the designated PDF extraction directory, particularly in sensitive locations such as /etc/cron.d/, web root directories, ~/.ssh/authorized_keys, or application deployment folders; files with timestamps correlating to PDF processing events.
• Logs: Application logs showing PDF extraction operations followed by file write errors or successes in unexpected paths; Java stack traces referencing PDComplexFileSpecification.getFilename() with unusual path values.
• Process: Unexpected execution of scripts or binaries shortly after a PDF file was processed by the application; new cron jobs or scheduled tasks appearing after document ingestion events.
• Network: Outbound connections from the application server to unknown external hosts following PDF processing, which may indicate a dropped web shell or reverse shell being triggered (GitHub PoC).

Apache has released fixed versions: 2.0.37 (for the 2.x branch) and 3.0.8 (for the 3.x branch), which apply canonical path validation to ensure extraction paths remain within the intended directory. Organizations that have copied the ExtractEmbeddedFiles example into production code should immediately audit their implementations and apply path canonicalization — converting both the base extraction path and the resolved output path to canonical forms and verifying the output path starts with the base path before writing. Do not use user-supplied or PDF-supplied filenames for file system operations without strict sanitization (Openwall OSS-Sec, Red Hat Bugzilla).

The vulnerability was disclosed by Tilman Hausherr (Apache PDFBox) via the oss-security mailing list on March 10, 2026, crediting Joakim Bülow of the Neo4j Security Team as the finder (Openwall OSS-Sec). Red Hat tracked the issue via Bugzilla with medium severity and assigned it to their Product Security DevOps Team, with 37 users CC'd indicating broad internal interest (Red Hat Bugzilla). Community discussion was noted on Bluesky and security aggregators shortly after disclosure, and IBM subsequently published advisories referencing the CVE for affected products (IBM Advisory).