CVE-2026-33929 Apache Software Foundation CVE debrief

Who should care

Users of Apache PDFBox versions 2.0.24 through 2.0.36 and 3.0.0 through 3.0.7, especially those who have copied the ExtractEmbeddedFiles example into their production code or have writing rights on potentially vulnerable paths.

Why it matters

CVE-2026-33929 is a medium-severity Path Traversal vulnerability in Apache PDFBox Examples. Users of affected versions should prioritize updating to version 2.0.37 or 3.0.8, or applying the provided fix, to prevent potential unauthorized file system modifications. Those who have incorporated the ExtractEmbeddedFiles example into production code should review and update their implementations. The vulnerability's impact is currently limited by the lack of reported exploitation or specific victim data.

• Potential unauthorized write access to file system paths
• Possible data integrity issues or unintended file modifications
• Need for immediate version updates or patch application
• Verification of production code for ExtractEmbeddedFiles example usage

Technical summary

The ExtractEmbeddedFiles example in Apache PDFBox contains a path traversal vulnerability (CWE-22) due to improper limitation of a pathname to a restricted directory. This issue allows users with writing rights on a specific path to be victims of a malicious PDF, potentially resulting in a write attempt to any path starting with that specific path. The vulnerability has a medium severity and requires immediate attention from users of affected Apache PDFBox versions, especially those who have copied the ExtractEmbeddedFiles example into their production code or have writing rights on potentially vulnerable paths. The issue can be mitigated by updating to version 2.0.37 or 3.0.8 once available or applying the fix

Defensive priority

Medium priority for users of affected Apache PDFBox versions, especially those with writing rights on potentially vulnerable paths.

Recommended defensive actions

• Update to Apache PDFBox version 2.0.37 or 3.0.8 once available
• Apply the fix provided in GitHub PR 427
• Review and update production code that has copied the ExtractEmbeddedFiles example
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and source references, including GitHub PR 427 and Apache security mailing lists. However, details on actual exploitation or victim impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.