Is CVE-2026-33929 actively exploited?

No active exploitation of CVE-2026-33929 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33929 be exploited remotely?

Yes. CVE-2026-33929 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33929?

CVE-2026-33929 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33929

MEDIUM

CVE-2026-33929

CWE-22Published: April 14, 2026· Updated: Apr 20, 2026

4.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:10.2th

Official Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the

ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.

Users are recommended to update to version 2.0.37 or 3.0.8 once

available. Until then, they should apply the fix provided in GitHub PR

427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example

has been changed accordingly and is available in the project repository.

NVD Source

Technical Analysis

CVE-2026-33929 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.