The ExtractEmbeddedFiles example in Apache PDFBox contains a path traversal flaw (CWE‑22). When a PDF references an embedded file, the filename returned by PDComplexFileSpecification.getFilename() is simply appended to a base extraction directory. An attacker can supply a filename that includes traversal sequences, causing the extraction code to write or read files outside the intended directory, potentially overwriting existing files or exposing sensitive data.

Apache Software Foundation’s PDFBox Examples are affected. The vulnerability exists in versions 2.0.24 through 2.0.35 and in 3.0.0 through 3.0.6. Any code that copies this example into production and runs it against untrusted PDFs would be vulnerable.

The CVSS score is 5.3, marking it as a medium‑severity flaw, and the EPSS score is below 1 %, indicating a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the vulnerability requires a PDF with a specially crafted filename and execution of the example code, it is a local‑level threat that could be triggered by a malicious file processed by an application running with elevated privileges. After the library authors updated the example to canonicalise paths and verify containment, the risk is mitigated if the latest example is used.