Path Traversal Vulnerability in PyMuPDF Affects File Processing Functionality

CVE-2026-82035

What is CVE-2026-82035?

PyMuPDF versions up to 1.28.2 are susceptible to a path traversal vulnerability in the font branch of the extract_objects() function. This issue arises due to the insecure handling of user-supplied output directory paths when constructing output filenames. An attacker can exploit this by providing a specially crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name that includes encoded path separators. If these are decoded into ../ sequences or absolute paths, it permits unauthorized file writes outside the designated output directory, all while bypassing any authentication or privilege requirements.

References