CVE-2026-23907

{
  "id": "CVE-2026-23907",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23907",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-10T17:51:34.025936Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache PDFBox Examples",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.24",
              "versionType": "semver",
              "lessThanOrEqual": "2.0.35"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.0.6"
            }
          ],
          "packageName": "org.apache.pdfbox:pdfbox-examples",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-10T18:18:16.960",
  "references": [
    {
      "url": "https://github.com/JoakimBulow/",
      "tags": [
        "Not Applicable"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/gyfq5tcrxfv7rx0z2yyx4hb3h53ndffw",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/10/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.\n\n\nThe ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because \nthe filename that is obtained from \nPDComplexFileSpecification.getFilename() is appended to the extraction path.\n\nUsers who have copied this example into their production code should \nreview it to ensure that the extraction path is acceptable. The example \nhas been changed accordingly, now the initial path and the extraction \npaths are converted into canonical paths and it is verified that \nextraction path contains the initial path. The documentation has also \nbeen adjusted."
    },
    {
      "lang": "es",
      "value": "Este problema afecta al ejemplo ExtractEmbeddedFiles en Apache PDFBox: desde 2.0.24 hasta 2.0.35, desde 3.0.0 hasta 3.0.6.\n\nEl ejemplo ExtractEmbeddedFiles contiene una vulnerabilidad de salto de ruta (CWE-22) porque el nombre de archivo que se obtiene de PDComplexFileSpecification.getFilename() se añade a la ruta de extracción.\n\nLos usuarios que han copiado este ejemplo en su código de producción deberían revisarlo para asegurarse de que la ruta de extracción es aceptable. El ejemplo ha sido modificado en consecuencia, ahora la ruta inicial y las rutas de extracción se convierten en rutas canónicas y se verifica que la ruta de extracción contiene la ruta inicial. La documentación también ha sido ajustada."
    }
  ],
  "lastModified": "2026-09-17T17:22:10.357",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41D7F404-F89C-409D-89B8-363197958350",
              "versionEndIncluding": "2.0.36",
              "versionStartIncluding": "2.0.24"
            },
            {
              "criteria": "cpe:2.3:a:apache:pdfbox-examples:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D586601-B04F-4349-A88D-9D36693022E7",
              "versionEndIncluding": "3.0.7",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}