CVE-2026-23907

The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) contains a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without sanitization, allowing a malicious PDF to write...