CVE-2026-82035 Overview
CVE-2026-82035 is a path traversal vulnerability [CWE-22] in PyMuPDF through version 1.28.2. The flaw resides in the font branch of the extract_objects() function in src/__main__.py. The output filename is constructed by joining a document-controlled BaseFont name onto a user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can craft a PDF, EPUB, XPS, or FB2 file containing a malicious BaseFont name that decodes to ../ sequences or absolute paths. Successful exploitation results in arbitrary file writes outside the intended output directory. Exploitation requires no authentication or elevated privileges, only that a victim processes the crafted document.
Critical Impact
Arbitrary file writes outside the intended output directory via a crafted document, enabling potential code execution through overwritten configuration or executable files.
Affected Products
- PyMuPDF through version 1.28.2
- Applications embedding PyMuPDF that invoke extract_objects() on untrusted documents
- Document processing pipelines accepting PDF, EPUB, XPS, or FB2 inputs
Discovery Timeline
- 2026-09-14 - CVE-2026-82035 published to NVD
- 2026-09-14 - Last updated in NVD database
- Patch committed to PyMuPDF repository in commit b2c8f3a859fed35c379a44df566f770dc3e18605
Technical Details for CVE-2026-82035
Vulnerability Analysis
The vulnerability exists in the font extraction branch of extract_objects() within src/__main__.py. PyMuPDF reads the BaseFont name directly from an embedded font object inside the parsed document. This attacker-controlled string is then passed to os.path.join() together with the user-specified output directory and a numeric xref suffix. Because os.path.join() treats absolute paths and traversal segments as authoritative, a BaseFont value beginning with / or containing ../ sequences resolves outside the intended directory. When the extracted font buffer is written via open(outname, "wb"), the file is created at the attacker-chosen location. The write occurs with the privileges of the invoking process.
Root Cause
The root cause is missing sanitization of a document-controlled string before it is used in filesystem path construction. The pre-patch code only replaced spaces in fontname, leaving forward slashes, backslashes, and dot segments intact. No canonicalization or containment check verified that the resolved path remained within out_dir.
Attack Vector
An attacker crafts a document with a font entry whose BaseFont name contains path separators or traversal sequences. When a victim or automated pipeline runs the PyMuPDF extract command against the file, the malicious font buffer is written to an attacker-chosen path. Overwriting SSH authorized_keys, cron files, systemd units, or web application configurations can escalate the primitive to code execution.
fontname, ext, _, buffer = doc.extract_font(xref)
if ext == "n/a" or not buffer:
continue
+ name = fontname
+ name = name.replace('/', '-')
+ name = name.replace('\\', '-')
+ name = name.replace(' ', '-')
outname = os.path.join(
- out_dir, f"{fontname.replace(' ', '-')}-{xref}.{ext}"
+ out_dir, f"{name}-{xref}.{ext}"
)
with open(outname, "wb") as outfile:
outfile.write(buffer)
Source: GitHub PyMuPDF Commit b2c8f3a. The patch replaces forward slashes, backslashes, and spaces in the font name with hyphens before path construction, preventing traversal sequences from surviving into os.path.join().
Detection Methods for CVE-2026-82035
Indicators of Compromise
- Files with font extensions (.ttf, .otf, .cff) appearing outside expected PyMuPDF output directories.
- Recently modified files in sensitive locations such as ~/.ssh/, /etc/cron.d/, or web roots on hosts running document processing jobs.
- Documents whose parsed BaseFont names contain /, \, or .. character sequences.
Detection Strategies
- Inspect PDF, EPUB, XPS, and FB2 files at ingest for BaseFont names that include path separators or dot-dot segments.
- Audit application logs for PyMuPDF extract invocations followed by writes resolving outside the declared output directory.
- Correlate file creation events from Python interpreter processes against expected working directories.
Monitoring Recommendations
- Enable filesystem auditing on directories writable by document processing service accounts.
- Alert on write operations by PyMuPDF worker processes to paths outside their configured output roots.
- Track installed PyMuPDF versions across build pipelines and container images to identify hosts still on 1.28.2 or earlier.
How to Mitigate CVE-2026-82035
Immediate Actions Required
- Upgrade PyMuPDF to a release containing commit b2c8f3a859fed35c379a44df566f770dc3e18605 or later.
- Audit systems that process untrusted documents with PyMuPDF and confirm no unauthorized file writes have occurred.
- Restrict service account privileges on document processing workers to the minimum required directories.
Patch Information
The fix is available in the upstream repository as commit b2c8f3a. It sanitizes the fontname value by replacing /, \, and space characters with - before constructing the output path. Review the GitHub PyMuPDF Commit and the VulnCheck PyMuPDF Advisory for details.
Workarounds
- Avoid invoking extract_objects() on documents from untrusted sources until the patched version is deployed.
- Run PyMuPDF extraction inside a sandbox or container with a read-only filesystem outside a scoped output volume.
- Wrap extract_objects() calls with a post-write check that verifies each created file resolves inside the configured output directory using os.path.realpath().
# Upgrade PyMuPDF to a patched release
pip install --upgrade PyMuPDF
# Verify the installed version no longer matches vulnerable 1.28.2
python -c "import fitz; print(fitz.__version__)"
# Optional: run extraction under a restricted user with a scoped output directory
sudo -u pymupdf-worker python -m fitz extract -fonts /srv/input/sample.pdf -output /srv/output/fonts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.