{"vuid":"VU#504749","idnumber":"504749","name":"PyMuPDF path traversal and arbitrary file write vulnerabilities","keywords":null,"overview":"### Overview\r\nA path traversal vulnerability leading to arbitrary file write exist in PyMuPDF version 1.26.5, within the ‘embedded_get’   function in ‘__main__.py’.  This vulnerability is caused by improper handling of untrusted embedded file metadata, which is used directly as an output path, enabling attackers to write files to arbitrary locations on the local system.\r\n \r\n### Description\r\nPyMuPDF is a Python interface to the MuPDF document rendering engine, providing capabilities for parsing, rendering, searching, and modifying PDF documents.\r\nThe ‘embedded_get’ function in PyMuPDF is responsible for opening the provided PDF along with fetching metadata, such as the file name, if using ‘args.output’ it specifies were the file will be written to on the local system.   When ‘args.output’   is not provided, the ‘embedded_get’ function falls back to embedded-file metadata, and opens that value in write-binary mode. Since write-binary mode has no constrictions or safety checks it can write anywhere to the local system.      \r\nIf the derived output path is not supplied by using ‘args.output’,    a crafted PDF can be used to target a location on the local system by using the PDF’s name. When an extracted embedded file using ‘embedded_get’ without specified ‘args.output, the tool can write the extracted content outside the intended directory, potentially to paths on the local system. \r\n\r\n### Impact\r\nSuccessful exploitation can result in arbitrary file writing to locations permitted by the executing user. If done under an account with elevated privileges, it may overwrite system files. This can lead to privilege escalation, service disruption, or security bypass. ### Overview\r\nA path traversal vulnerability leading to arbitrary file write exists in PyMuPDF version 1.26.5, within the `embedded_get`    function in `__main__.py`.  This vulnerability is caused by improper handling of untrusted embedded file metadata, which is used directly as an output path, enabling attackers to write files to arbitrary locations on the local system.\r\n \r\n### Description\r\nPyMuPDF is a Python interface to the MuPDF document rendering engine, providing capabilities for parsing, rendering, searching, and modifying PDF documents.\r\nThe `embedded_get` function in PyMuPDF is responsible for opening the provided PDF along with fetching metadata, such as the file name. If using `args.output`, it specifies where the file will be written on the local system.   When `args.output`   is not provided, the `embedded_get` function falls back to embedded file metadata and opens that value in write-binary mode. Since write-binary mode has no constrictions nor safety checks, it can write to anywhere on the local system.      \r\nIf the derived output path is not supplied with `args.output`,    a crafted PDF can be used to target a location on the local system using the name of the PDF. When an embedded file is extracted using `embedded_get` without specified `args.output`, the tool can write the extracted content outside the intended directory, potentially to paths on the local system. \r\n\r\n### Impact\r\nSuccessful exploitation can result in arbitrary file writing to locations permitted by the executing user. If done under an account with elevated privileges, it may overwrite system files. This can lead to privilege escalation, service disruption, or security bypass. \r\n### Solution\r\nPyMuPDF has released version 1.26.7 to address this vulnerability. Affected users are encouraged to update as soon as possible. \r\n\r\n### Acknowledgements\r\nThanks to the reporter UKO. This document was written by Michael Bragg.\r\n\r\n\r\n### Solution\r\nPyMuPDF has released version 1.26.7 to address this vulnerability. Affected users are encouraged to update as soon as possible. \r\n\r\n### Acknowledgements\r\nThanks to the reporter Jangwoo Choe (UKO). This document was written by Michael Bragg.\r\n\r\n**CVE-2026-3029**\r\nA path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["http://github.com/pymupdf/PyMuPDF","http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a"],"cveids":["CVE-2026-3029"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-02-12T18:05:13.074397Z","publicdate":"2026-02-12T18:05:12.897457Z","datefirstpublished":"2026-02-12T18:05:13.094066Z","dateupdated":"2026-03-19T15:53:54.449994Z","revision":4,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":175}