CVE-2026-23907

CVE-2026-23907 describes a path traversal vulnerability (CWE-22) in the ExtractEmbeddedFiles example code of Apache PDFBox versions 2.0.24-2.0.35 and 3.0.0-3.0.6. This medium-severity issue (CVSS 5.3) allows an unauthenticated attacker, with low attack complexity, to potentially cause limited information disclosure (C:L) by manipulating filenames during the extraction process. There is no evidence of active exploitation, public exploit code, or significant community attention, with its EPSS score indicating a very low probability of exploitation. Users who have incorporated this example into their production code are advised to review and update their implementations to ensure proper path validation, as the example has been patched accordingly.