An update for pdfbox is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2148 Final 1.0 1.0 2026-05-03 Initial 2026-05-03 2026-05-03 openEuler SA Tool V1.0 2026-05-03 pdfbox security update An update for pdfbox is now available for openEuler-24.03-LTS-SP3 Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0. Security Fix(es): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository.(CVE-2026-33929) An update for pdfbox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium pdfbox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2148 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-33929 https://nvd.nist.gov/vuln/detail/CVE-2026-33929 openEuler-24.03-LTS-SP3 fontbox-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-debugger-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-javadoc-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-parent-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-reactor-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-tools-2.0.29-2.oe2403sp3.noarch.rpm preflight-2.0.29-2.oe2403sp3.noarch.rpm xmpbox-2.0.29-2.oe2403sp3.noarch.rpm pdfbox-2.0.29-2.oe2403sp3.src.rpm Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427. The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF". Users who have copied this example into their production code should apply the mentioned change. The example has been changed accordingly and is available in the project repository. 2026-05-03 CVE-2026-33929 openEuler-24.03-LTS-SP3 Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N pdfbox security update 2026-05-03 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2148