This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from     3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22)     because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the     extraction path. Users who have copied this example into their production code should review it to ensure     that the extraction path is acceptable. The example has been changed accordingly, now the initial path and     the extraction paths are converted into canonical paths and it is verified that extraction path contains     the initial path. The documentation has also been adjusted. (CVE-2026-23907)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from
    3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22)
    because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the
    extraction path. Users who have copied this example into their production code should review it to ensure
    that the extraction path is acceptable. The example has been changed accordingly, now the initial path and
    the extraction paths are converted into canonical paths and it is verified that extraction path contains
    the initial path. The documentation has also been adjusted. (CVE-2026-23907)

ID	Name	Product	Family	Type	Severity
301969	Linux Distros Unpatched Vulnerability : CVE-2026-23907	Nessus	Misc.	Local	medium
438640	SCA: security update for org.apache.pdfbox:pdfbox-examples (GHSA-jjwr-xmw6-gf78)	Tenable Cloud Security	SCA Checks	Local	medium
438640	SCA: security update for org.apache.pdfbox:pdfbox-examples (GHSA-jjwr-xmw6-gf78)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-23907

medium

Tenable Plugins

medium

medium

medium