Improper limitation of a pathname to a restricted directory has been found in the ExtractEmbeddedFiles example of Apache PDFBox. The flaw allows a malicious PDF file to direct the example code to write to any location that begins with the user’s home directory, such as /home/ABCDEF when the example runs with writing rights on /home/ABC. This can result in the creation or modification of files outside the intended sandbox, compromising confidentiality, integrity, or availability.

The issue affects users who have incorporated the ExtractEmbeddedFiles example from Apache PDFBox. Apache PDFBox Versions 2.0.24 through 2.0.36 and 3.0.0 through 3.0.7 are impacted. The example is maintained by the Apache Software Foundation under the PDFBox Examples project.

The CVSS score is not provided, but the vulnerability is a typical CWE-22 path traversal that permits arbitrary file write when the example runs with file‑system write permissions. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local user running the example or a service that incorporates the example in its code base. Exploit would require a crafted PDF containing a malicious embedded file name that attempts to climb out of the expected directory.