CVE catalog

CVE-2026-82035

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpymupdfsid1.28.2+ds1-1vulnerable
Debianpymupdfforky1.28.2+ds1-1vulnerable
Debianpymupdftrixie1.25.4+ds1-3+deb13u1vulnerable
Debianpymupdfbookworm1.21.1+ds1-1vulnerable
Opensusepython-PyMuPDFleap 16.01.21.1-lp160.6.1fixed
Opensusepython-PyMuPDFtumbleweed1.28.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpymupdfsourcesid(unfixed)not yet assignedNot reportedNot reported
Debianpymupdfsourceforky(unfixed)not yet assignedNot reportedNot reported
Debianpymupdfsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianpymupdfsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensusepython-PyMuPDFrpmleap 16.01.21.1-lp160.6.1Not reportedOPENSUSE-SU-2026:21912-1Not reported
Opensusepython-PyMuPDFrpmtumbleweed1.28.2-1.1Not reportedOPENSUSE-SU-2026:11824-1Not reported

Notes

[trixie] pymupdf: Minor issue [bookworm] pymupdf: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-fitz]Affected

    Source package: [pymupdf]

    Details (2)

    • 1.21.1+ds1-1+b4 · amd64 · bookworm

      Affected

      nvd · pymupdf · debian · bookworm; nvd · pymupdf · debian · 12

    • 1.21.1+ds1-1+b4 · arm64 · bookworm

      Affected

      nvd · pymupdf · debian · bookworm; nvd · pymupdf · debian · 12

[Debian 13 (Trixie)]

  • [python3-fitz]Affected

    Source package: [pymupdf]

    Details (2)

    • 1.25.4+ds1-3+deb13u1 · all · trixie

      Affected

      nvd · pymupdf · debian · 13

    • 1.25.4+ds1-3+deb13u1 · all · trixie

      Affected

      nvd · pymupdf · debian · 13

  • [python3-pymupdf]Affected

    Source package: [pymupdf]

    Details (2)

    • 1.25.4+ds1-3+deb13u1 · amd64 · trixie

      Affected

      nvd · pymupdf · debian · 13

    • 1.25.4+ds1-3+deb13u1 · arm64 · trixie

      Affected

      nvd · pymupdf · debian · 13

[openSUSE Tumbleweed]

  • [python313-PyMuPDF]Unknown

    Source package: [python-PyMuPDF]

    Details (1)

    • 1.27.2.2-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.28.2-1.1

      Version impact unknown

      nvd · python-PyMuPDF · opensuse · tumbleweed

  • [python313-PyMuPDF-devel]Unknown

    Source package: [python-PyMuPDF]

    Details (1)

    • 1.27.2.2-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.28.2-1.1

      Version impact unknown

      nvd · python-PyMuPDF · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]