Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82035— PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch

Quick assessment

Affected
PyMuPDF PyMuPDF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述的专业中文翻译： PyMuPDF 版本 1.28.2 及更早版本（已在提交 b2c8f3a 中修复）在 的 函数字体处理分支中存在路径遍历（path traversal）漏洞。该漏洞的成因是：输出文件名通过直接将文档中控制的 BaseFont 名称拼接在用户指定的输出目录之后，而未移除路径分隔符或 序列。 攻击者可以通过提供特制的 PDF、EPUB、XPS 或 FB2 文件，其中 BaseFont 名称包含经解码后变为 序列或绝对路径的编码路径分隔符，从而在无需身份验证或提升权限的情况下，实现任意

CVSS 7.1 · High

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Affected Version Matrix 2

VendorProduct Version RangeStatus
PyMuPDF PyMuPDF ≤ 1.8.2 affected
b2c8f3a859fed35c379a44df566f770dc3e18605 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82035

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
Source: CVE Program / CVE List V5
Vulnerability Description
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PyMuPDF PyMuPDF 0 ~ 1.8.2 -

II. Public POCs for CVE-2026-82035

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82035

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82035 (1)

Vendor Advisories for CVE-2026-82035 (1)

IV. Related Vulnerabilities

Same product: PyMuPDF
Same weakness: CWE-22

V. Comments for CVE-2026-82035

No comments yet

Leave a comment