https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:03:58.060838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291358 EUVD-2026-291358 2026-10-04T04:03:58.272676+00:00 EUVD-2026-291358 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33929 fkie_cve-2026-33929 2026-10-04T04:03:58.272714+00:00

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

 https://cve.radiocsirt.org/vuln/ghsa-gcj8-76p4-g2fq GHSA-gcj8-76p4-g2fq — Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code 2026-10-04T04:03:58.272765+00:00

Affected: Maven: org.apache.pdfbox:pdfbox-examples

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0312 NCSC-2026-0312 — Kwetsbaarheden verholpen in Oracle Financial Services 2026-10-04T04:03:58.272800+00:00 NCSC-2026-0312 https://cve.radiocsirt.org/vuln/oesa-2026-2147 OESA-2026-2147 — pdfbox security update 2026-10-04T04:03:58.272825+00:00

Affected: openEuler:24.03-LTS: pdfbox

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0. Security Fix(es):

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10550-1 openSUSE-SU-2026:10550-1 — apache-pdfbox-2.0.36-1.1 on GA media 2026-10-04T04:03:58.272857+00:00

apache-pdfbox-2.0.36-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:22088-1 SUSE-SU-2026:22088-1 — Security update for apache-pdfbox 2026-10-04T04:03:58.272874+00:00

Security update for apache-pdfbox

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33929 UBUNTU-CVE-2026-33929 2026-10-04T04:03:58.272890+00:00

Affected: Ubuntu:16.04:LTS: libpdfbox-java, Ubuntu:18.04:LTS: libpdfbox-java, Ubuntu:18.04:LTS: libpdfbox2-java, Ubuntu:20.04:LTS: libpdfbox-java, Ubuntu:20.04:LTS: libpdfbox2-java, Ubuntu:22.04:LTS: libpdfbox-java, Ubuntu:22.04:LTS: libpdfbox2-java, Ubuntu:24.04:LTS: libpdfbox-java, Ubuntu:24.04:LTS: libpdfbox2-java, Ubuntu:25.10: libpdfbox-java and 3 more

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1687 WID-SEC-W-2026-1687 — IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2026-10-04T04:03:58.272932+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.