CyberRota Analysis
AI-GeneratedPyMuPDF versions up to 1.28.2 are vulnerable to a path traversal vulnerability that allows attackers to exploit the font branch of the extract_objects() function, enabling arbitrary file writes outside the designated output directory. By providing a specially crafted document, such as a PDF or EPUB, with a malicious BaseFont name, an attacker can manipulate file paths to access unauthorized locations on the filesystem. Organizations using PyMuPDF should prioritize patching this vulnerability to prevent potential data breaches and unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.