CVE-2026-3029: PyMuPDF Path Traversal Vulnerability

CVE-2026-3029 Overview

A path traversal and arbitrary file write vulnerability exists in the embedded get function within _main_.py in PyMuPDF version 1.26.5. This vulnerability allows an attacker to write arbitrary files to locations outside the intended directory by exploiting insufficient path validation in the pymupdf embed-extract functionality.

Critical Impact

Attackers can leverage this path traversal vulnerability to write malicious files to arbitrary locations on the filesystem, potentially leading to code execution, configuration tampering, or system compromise.

Affected Products

• PyMuPDF version 1.26.5
• Applications using PyMuPDF's embedded file extraction functionality
• Systems processing untrusted PDF documents with embedded files

Discovery Timeline

• 2026-03-19 - CVE-2026-3029 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-3029

Vulnerability Analysis

The vulnerability resides in PyMuPDF's pymupdf embed-extract command, which is used to extract embedded files from PDF documents. In version 1.26.5, this functionality does not adequately validate or sanitize the output path, allowing malicious embedded filenames containing path traversal sequences (such as ../) to escape the intended output directory.

When a user extracts an embedded file from a specially crafted PDF document, the attacker-controlled filename can direct the extracted content to arbitrary locations on the filesystem. This type of vulnerability is commonly known as a "Zip Slip" variant, where archive extraction routines fail to properly constrain output paths.

The impact of this vulnerability is significant because PDF documents are commonly shared and processed, often in automated workflows. An attacker can embed a malicious file with a traversal path, and when the victim extracts it, the file is written to a sensitive location such as configuration directories, startup folders, or web server roots.

Root Cause

The root cause is insufficient input validation in the _main_.py file's embedded file extraction logic. The vulnerable code failed to verify that the output path remains within the current working directory or a user-specified safe location. Without these checks, filenames containing directory traversal sequences like ../ are processed literally, allowing file writes outside the expected directory.

Attack Vector

An attacker can exploit this vulnerability by:

1. Creating a malicious PDF document with an embedded file containing path traversal sequences in its filename
2. Distributing the PDF to a victim through email, file sharing, or other means
3. When the victim uses pymupdf embed-extract to extract the embedded file, it is written to an attacker-controlled location on the filesystem

The attack requires user interaction (extracting the embedded file) but can be devastating in automated processing pipelines where PDF documents are processed without manual review.

 Other:
 
   * Retrospectively mark `4756 <https://github.com/pymupdf/PyMuPDF/issues/4756>`_ as fixed in 1.26.6.
+  * Improved safety of `pymupdf embed-extract`. This now refuses to write to
+    an existing file or outside current directory, unless `-output` or new flag
+    `-unsafe` is specified.
 
 
 **Changes in version 1.26.6** (2025-11-05)

Source: GitHub Commit Details

Detection Methods for CVE-2026-3029

Indicators of Compromise

• Unexpected files appearing outside of intended extraction directories
• PDF documents containing embedded files with suspicious filenames including ../ sequences
• Log entries showing file writes to sensitive system directories during PDF processing
• Modified system configuration files or executables with timestamps correlating to PDF extraction activities

Detection Strategies

• Monitor filesystem activity for file writes containing path traversal patterns during PDF processing operations
• Implement file integrity monitoring on critical system directories and configuration files
• Review application logs for pymupdf embed-extract operations and validate output paths
• Deploy endpoint detection rules to identify PDF documents with embedded files containing traversal sequences

Monitoring Recommendations

• Enable detailed logging for all PyMuPDF operations in production environments
• Configure SIEM alerts for file creation events in sensitive directories that correlate with PDF processing
• Implement behavioral monitoring to detect applications writing files outside their normal working directories
• Regularly audit systems processing PDF documents for unexpected file modifications

How to Mitigate CVE-2026-3029

Immediate Actions Required

• Upgrade PyMuPDF to version 1.26.6 or later which includes the security fix
• Review any systems or workflows that use pymupdf embed-extract for potential compromise
• Implement input validation at the application layer if immediate upgrade is not possible
• Audit recently extracted PDF embedded files for signs of exploitation

Patch Information

The vulnerability has been addressed in the GitHub Commit. The fix modifies the pymupdf embed-extract command to refuse writing to existing files or locations outside the current directory by default. Users who need the previous behavior can use the -output flag to specify a safe destination or the new -unsafe flag to explicitly opt into the risky behavior.

Additional information is available in CERT Vulnerability Report #504749.

Workarounds

• Always specify an explicit output directory using the -output flag when extracting embedded files
• Process untrusted PDF documents in sandboxed or containerized environments with restricted filesystem access
• Implement application-level path validation before passing filenames to PyMuPDF extraction functions
• Use principle of least privilege for processes handling PDF extraction to limit potential damage

 Extract an embedded file like this::
 
     pymupdf embed-extract -h
-    usage: pymupdf embed-extract [-h] -name NAME [-password PASSWORD] [-output OUTPUT]
+    usage: pymupdf embed-extract [-h] -name NAME [-password PASSWORD] [-unsafe] [-output OUTPUT]
                             input
 
     ---------------------- extract embedded file to disk ----------------------

Source: GitHub Commit Details