Description

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T19:17:50.380Z",
  "pubdate": "2026-09-14T19:17:50.380Z",
  "executiveSummary": "PyMuPDF versions through 1.28.2 are susceptible to an arbitrary file write vulnerability resulting from improper neutralization of special elements in file paths, categorized as a path traversal flaw.\nThe vulnerability originates in the extract_objects() function within src/__main__.py, where untrusted BaseFont names extracted from document metadata are concatenated directly with user-defined output directory paths.\nBy crafting malicious PDF, EPUB, XPS, or FB2 files containing directory traversal sequences (e.g., ../) or absolute paths within the BaseFont attribute, an attacker can coerce the library to write files outside the intended destination directory.\nSuccessful exploitation allows unauthenticated attackers to overwrite critical system files or place malicious payloads in arbitrary locations, potentially leading to remote code execution or complete system compromise depending on the context and permissions of the process executing PyMuPDF.\nNo authentication or elevated privileges are required for exploitation, as the vulnerability is triggered automatically upon processing the malformed document. The risk is significant for automated processing services that handle untrusted user-submitted files.",
  "technicalDetails": "The vulnerability resides within the font processing logic of the extract_objects() function located in src/__main__.py. The flaw is fundamentally an input validation failure occurring during the construction of file paths for extracted font assets.\nRoot cause analysis reveals that the application logic trustingly uses the BaseFont name property—retrieved directly from the internal structure of PDF, EPUB, XPS, or FB2 documents—as a component of the local filesystem path. The implementation fails to sanitize or validate this string against path traversal characters, such as dot-dot-slash (../) or absolute path indicators (e.g., / or C:\\).\nThe attack flow begins when an attacker embeds a malicious BaseFont identifier into a document. When a user or automated service invokes PyMuPDF to extract objects from this document, the library parses the Font dictionary or equivalent metadata structure. The extract_objects() function proceeds to construct an output filename by performing a path join operation between a user-supplied directory prefix and the malicious BaseFont string.\nBecause the BaseFont name is not subjected to a normalization process or a 'jail' check to ensure the resulting path resides within the intended root directory, the underlying operating system resolves the traversal sequences. This allows the process to write to directories beyond the designated output folder.\nFor example, if the output directory is set to '/tmp/output/' and the attacker sets the BaseFont name to '../../home/user/.ssh/authorized_keys', the resulting file write operation attempts to access '/tmp/output/../../home/user/.ssh/authorized_keys', effectively escaping the intended directory and reaching the targeted file on the filesystem.\nThe vulnerability affects all versions of PyMuPDF up to and including 1.28.2. It is mitigated in commit b2c8f3a. Exploitation is deterministic and requires no user interaction beyond the standard processing of the weaponized file. The post-exploitation impact is limited only by the filesystem permissions of the user account running the PyMuPDF instance, making it a critical vector for privilege escalation or configuration tampering in environments where file conversion or extraction services are deployed."
}