The ExtractEmbeddedFiles example in Apache Software Foundation:Apache PDFBox Examples contains a path traversal flaw (CWE‑22) that lets a crafted PDF cause the code to write to unintended files. Because the example does not handle file path separators properly, an attacker can target any path beginning with the current user’s home directory prefix, creating or overwriting files and potentially exposing sensitive data or enabling further compromise.

This issue affects Apache Software Foundation:Apache PDFBox Examples versions 2.0.24 through 2.0.36 and 3.0.0 through 3.0.7. Users who have incorporated this example into production code should upgrade to version 2.0.37 or 3.0.8 when released, or apply the code change from GitHub pull request 427.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score below 1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers must provide a malicious PDF to a user running the vulnerable example and require write permissions in the user's home directory. Successful exploitation would allow the attacker to create or modify files under the victim’s home directory, compromising confidentiality and integrity for that user but not affecting the entire system.