Описание
This issue affects the
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.
The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because
the filename that is obtained from
PDComplexFileSpecification.getFilename() is appended to the extraction path.
Users who have copied this example into their production code should
review it to ensure that the extraction path is acceptable. The example
has been changed accordingly, now the initial path and the extraction
paths are converted into canonical paths and it is verified that
extraction path contains the initial path. The documentation has also
been adjusted.
A path traversal vulnerability was identified in the ExtractEmbeddedFiles example provided with Apache PDFBox. The example code constructs extraction paths by directly appending filenames obtained from PDComplexFileSpecification.getFilename() without validating the resulting path. An attacker could exploit this behavior by embedding files in a PDF document with crafted filenames containing path traversal sequences. If the example code is reused in an application without modification, this could cause extracted files to be written outside the intended extraction directory, potentially leading to data corruption or unauthorized file creation.
Отчет
Red Hat Product Security rates this issue as Moderate severity, because the vulnerable code exists in the example implementation shipped with Apache PDFBox and is not part of the core library functionality. Applications that copied or reused the ExtractEmbeddedFiles example code without adding proper path validation may allow path traversal during extraction of embedded files from PDF documents. The impact is limited to the permissions of the application processing the PDF. Systems that do not use this example code or that properly sanitize extraction paths are not affected.
Меры по смягчению последствий
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | pdfbox | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox-io | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | pdfbox-tools | Fix deferred | ||
| Red Hat Data Grid 8 | pdfbox | Fix deferred | ||
| Red Hat Fuse 7 | pdfbox | Fix deferred | ||
| Red Hat Fuse 7 | pdfbox-tools | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | pdfbox | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | pdfbox-tools | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | pdfbox | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
This issue affects the ExtractEmbeddedFiles example inApache PDFBox: ...
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
6.5 Medium
CVSS3