CVE-2026-82035: PyMuPDF, обхождане на път

Описание

Оригинално описание

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

Засегнати продукти

• PyMuPDF PyMuPDF: до 1.8.2; b2c8f3a859fed35c379a44df566f770dc3e18605

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в PyMuPDF PyMuPDF

• 7.7CVE-2026-120752

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-82035
• https://nvd.nist.gov/vuln/detail/CVE-2026-82035
• https://github.com/pymupdf/PyMuPDF/commit/b2c8f3a859fed35c379a44df566f770dc3e18605
• https://www.vulncheck.com/advisories/pymupdf-path-traversal-via-extract-objects-font-branch