CVE-2026-23907

Apache PDFBox Path Traversal Vulnerability Vulnerability Summary Description Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences ../ to write files to arbitrary filesystem...

...[ More ]

Apache PDFBox version 3.0.8 is prone to a denial of service condition caused by a disproportionate heap allocation in the Flate decode PNG predictor path. When a stream is filtered with FlateDecode and a predictor is declared, PDFBox sizes an internal decoding buffer directly from the PDF-supplie...

Apache PDFBox 3.0.8 Flate PNG Predictor Disproportionate Heap Allocation DoS

Summary The Apache PDFBox library is an open source Java tool for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command-line utilities...

Security Bulletin: IBM Engineering Lifecycle Management - DOORS Next is impacted by vulnerability in Apache PDFBox

Summary Vulnerability have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management - DOORS Next. Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFB...

io.github.dawncord:dawncord (>=1.0.0, <=1.4.0), io.github.dimas4ek:dawncord (1.0.0) +4 more potentially affected by CVE-2026-59641 via org.bouncycastle:bcmail-jdk15to18 (>=1.75, <=1.78.1)

org.bouncycastle:bcmail-jdk15to18 MAVEN version =1.75, =1.0.0, =1.3.12, =2.12.0 Source cves: CVE-2026-59641 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512863...

PDF CVE-2017-9096 XXE XFA Form

Generate PDF PoC for CVE-2017-9096: XXE in AcroForm /XFA XML stream for server-side PDF processors. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexfaacroform class ModuleAuxiliary, PdfCveMixin:...

PDF CVE-2016-2175 XXE XMP Metadata

Generate PDF PoC for CVE-2016-2175: XXE in XMP /Metadata stream targeting server-side parsers PDFBox, iText. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexmpmetadata class ModuleAuxiliary,...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in Apache PDFBox

Summary Vulnerabilities have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management -Engineering Workflow Management Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issu...

openSUSE 16 Security Update : apache-pdfbox (openSUSE-SU-2026:20923-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20923-1 advisory. Update to version 2.0.36. Security issues fixed: - CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary...

SUSE-SU-2026:22088-1 Security update for apache-pdfbox

This update for apache-pdfbox fixes the following issues: Update to version 2.0.36. Security issues fixed: - CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes bsc1262046. Other updates and bugfixes: - Version 2.0.36: - XMPBox removes...

OPENSUSE-SU-2026:20923-1 Security update for apache-pdfbox

This update for apache-pdfbox fixes the following issues: Update to version 2.0.36. Security issues fixed: - CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes bsc1262046. Other updates and bugfixes: - Version 2.0.36: - XMPBox removes...

Security Bulletin: There is a vulnerability in pdfbox-2.0.28.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-33929)

Summary There is a vulnerability in pdfbox-2.0.28.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-33929 DESCRIPTION: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache PDFBox Examples...

Security Bulletin: There is a vulnerability in pdfbox-2.0.28.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-33929)

Summary There is a vulnerability in pdfbox-2.0.28.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-33929 DESCRIPTION: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache PDFBox Examples...

Unity Linux 20.1060e / 20.1070e Security Update: pdfbox (UTSA-2026-017627)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017627 advisory. In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree...

Unity Linux 20.1060e / 20.1070e Security Update: pdfbox (UTSA-2026-017622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017622 advisory. In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted or fuzzed file can trigger an infinite loop which leads to an out of memory exception in...

OESA-2026-2239 pdfbox security update

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

OESA-2026-2238 pdfbox security update

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

OESA-2026-2240 pdfbox security update

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

OESA-2026-2148 pdfbox security update

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

OESA-2026-2147 pdfbox security update

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...