CVE-2026-82035: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82035 is a path traversal vulnerability in PyMuPDF (versions through 1.28.2) affecting the font branch of the extract_objects() function in src/__main__.py. The flaw allows an attacker to supply a crafted PDF, EPUB, XPS, or FB2 file with a malicious BaseFont name containing encoded path separators (e.g., ../ sequences or absolute paths), causing arbitrary file writes outside the intended output directory. No authentication or elevated privileges are required, though user interaction (opening a malicious document) is needed. The vulnerability was disclosed on September 14, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, VulnCheck Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). In the vulnerable code path within extract_objects(), the output filename is constructed by directly joining the document-controlled BaseFont name onto the user-supplied output directory using os.path.join(), without first stripping path separators (/, \) or dot-dot sequences. A crafted document can embed a BaseFont value such as ../../etc/cron.d/malicious, which, when joined with the output directory, resolves to a path outside the intended directory. The fix (commit b2c8f3a) sanitizes the font name by replacing /, \, and space characters with - before constructing the output path (GitHub Commit, Red Hat Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the process running PyMuPDF, limited only by the operating system's file permissions. This poses a high integrity risk — attackers could overwrite configuration files, inject malicious scripts, or plant web shells in web-accessible directories. Availability impact is rated low, as file overwrites could corrupt application data or disrupt services. There is no direct confidentiality impact from this vulnerability (Red Hat Advisory, VulnCheck Advisory).

As of the disclosure date (September 14, 2026), there is no evidence of in-the-wild exploitation, no public proof-of-concept code, and no CISA KEV catalog listing for this CVE. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. Exploitation is not fully automated (user interaction is required to process the malicious document), which limits mass exploitation potential (Red Hat Advisory, VulnCheck Advisory).

1. Craft a malicious document: Create a PDF, EPUB, XPS, or FB2 file with an embedded font whose BaseFont name contains path traversal sequences, such as ../../target/directory/malicious_file or an absolute path like /etc/cron.d/backdoor.
2. Deliver the document: Distribute the crafted file to a target user or system that processes documents using PyMuPDF's extract_objects() CLI functionality (e.g., via email, file share, or upload to a document processing service).
3. Trigger extraction: The victim (or an automated pipeline) runs PyMuPDF's extraction command against the malicious document, e.g., python -m fitz extract -output /safe/output/dir malicious.pdf.
4. Path traversal occurs: PyMuPDF constructs the output filename by joining the unsanitized BaseFont name with the output directory, resolving to a path outside the intended directory (e.g., /safe/output/dir/../../target/directory/malicious_file).
5. Arbitrary file write: The extracted font data is written to the attacker-controlled path, potentially overwriting critical files or planting malicious content (GitHub Commit, VulnCheck Advisory).

• File System: Unexpected files appearing outside the designated PyMuPDF output directory, particularly in sensitive locations such as /etc/, web root directories, or user home directories; files with font-related extensions (.ttf, .otf, .cff, .woff) in unusual locations.
• Logs: Application or system logs showing PyMuPDF (python -m fitz) writing files to paths containing .. sequences or absolute paths outside the expected output directory; OS-level audit logs (e.g., auditd) recording file creation events by the Python process in unexpected directories.
• Process: Python processes invoking PyMuPDF's extract_objects functionality against externally supplied documents, especially in automated document processing pipelines.

Users should upgrade PyMuPDF to a version that includes commit b2c8f3a859fed35c379a44df566f770dc3e18605, which sanitizes font names by replacing /, \, and space characters with - before constructing output file paths. As a workaround, avoid processing untrusted PDF, EPUB, XPS, or FB2 documents with PyMuPDF's extract_objects() functionality until patched. Additionally, running PyMuPDF document processing in a sandboxed environment with restricted filesystem permissions can limit the impact of exploitation (GitHub Commit, VulnCheck Advisory).