cve-2026-33929
MEDIUM CVSS 6.5 csaf_suse
Description
SUSE CVE-2026-33929
Timeline
- Published
- 2026-04-14 23:26 UTC
- Last Modified
- 2026-07-15
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SUSE CVE-2026-33929",
"title": "Title"
},
{
"category": "description",
"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.\n\nThis issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.\n\n\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.\n\nThe ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. \"/home/ABCDEF\".\n\nUsers who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository.",
"title": "Description of the CVE"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33929",
"url": "https://www.suse.com/security/cve/CVE-2026-33929"
},
{
"category": "external",
"summary": "SUSE Security Ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "external",
"summary": "SUSE Bug 1262046 for CVE-2026-33929",
"url": "https://bugzilla.suse.com/1262046"
},
{
"category": "external",
"summary": "Advisory link for SUSE-SU-2026:22088-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047309.html"
}
],
"title": "SUSE CVE CVE-2026-33929",
"tracking": {
"current_release_date": "2026-07-15T05:18:21Z",
"generator": {
"date": "2026-04-14T23:26:22Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf-vex.pl",
"version": "1"
}
},
"id": "CVE-2026-33929",
"initial_release_date": "2026-04-14T23:26:22Z",
"revision_history": [
{
"date": "2026-04-14T23:26:22Z",
"number": "2",
"summary": "vulnerabilities added,references added,severity changed from to moderate"
},
{
"date": "2026-04-16T09:00:18Z",
"number": "3",
"summary": "scores added,updates released"
},
{
"date": "2026-07-15T05:18:21Z",
"number": "4",
"summary": "more updates released,more updates marked as not affected,references added"
}
],
"status": "interim",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Desktop 15 SP7",
"product_id": "SUSE Linux Enterprise Desktop 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-development-tools:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP1",
"product_id": "SUSE Linux Enterprise Server 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2",
"product_id": "SUSE Linux Enterprise Server 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3",
"product_id": "SUSE Linux Enterprise Server 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4",
"product_id": "SUSE Linux Enterprise Server 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5",
"product_id": "SUSE Linux Enterprise Server 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6",
"product_id": "SUSE Linux Enterprise Server 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP7",
"product_id": "SUSE Linux Enterprise Server 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product_id": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_teradata:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
},
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox",
"product": {
"name": "apache-pdfbox",
"product_id": "apache-pdfbox",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox@?upstream=apache-pdfbox.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox-2.0.36-1.1",
"product": {
"name": "apache-pdfbox-2.0.36-1.1",
"product_id": "apache-pdfbox-2.0.36-1.1",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:2.0.36:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox@2.0.36-1.1?upstream=apache-pdfbox-2.0.36-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox-2.0.36-160000.1.1",
"product": {
"name": "apache-pdfbox-2.0.36-160000.1.1",
"product_id": "apache-pdfbox-2.0.36-160000.1.1",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:2.0.36:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox@2.0.36-160000.1.1?upstream=apache-pdfbox-2.0.36-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox-javadoc",
"product": {
"name": "apache-pdfbox-javadoc",
"product_id": "apache-pdfbox-javadoc",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox-javadoc@?upstream=apache-pdfbox.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox-javadoc-2.0.36-1.1",
"product": {
"name": "apache-pdfbox-javadoc-2.0.36-1.1",
"product_id": "apache-pdfbox-javadoc-2.0.36-1.1",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:2.0.36:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox-javadoc@2.0.36-1.1?upstream=apache-pdfbox-2.0.36-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"product": {
"name": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"product_id": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:pdfbox:2.0.36:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/apache-pdfbox-javadoc@2.0.36-160000.1.1?upstream=apache-pdfbox-2.0.36-160000.1.1.src.rpm"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-2.0.36-160000.1.1 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:apache-pdfbox-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-2.0.36-160000.1.1",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-javadoc-2.0.36-160000.1.1 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-2.0.36-160000.1.1 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-2.0.36-160000.1.1",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-javadoc-2.0.36-160000.1.1 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-2.0.36-160000.1.1 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apache-pdfbox-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-2.0.36-160000.1.1",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-javadoc-2.0.36-160000.1.1 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1"
},
"product_reference": "apache-pdfbox-javadoc-2.0.36-160000.1.1",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-2.0.36-1.1 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:apache-pdfbox-2.0.36-1.1"
},
"product_reference": "apache-pdfbox-2.0.36-1.1",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-javadoc-2.0.36-1.1 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:apache-pdfbox-javadoc-2.0.36-1.1"
},
"product_reference": "apache-pdfbox-javadoc-2.0.36-1.1",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP7",
"product_id": "SUSE Linux Enterprise Server 15 SP7:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Desktop 15 SP7",
"product_id": "SUSE Linux Enterprise Desktop 15 SP7:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP7:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise High Performance Computing 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP1",
"product_id": "SUSE Linux Enterprise Server 15 SP1:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP2",
"product_id": "SUSE Linux Enterprise Server 15 SP2:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP3",
"product_id": "SUSE Linux Enterprise Server 15 SP3:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP4",
"product_id": "SUSE Linux Enterprise Server 15 SP4:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP5",
"product_id": "SUSE Linux Enterprise Server 15 SP5:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP6",
"product_id": "SUSE Linux Enterprise Server 15 SP6:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server Teradata 15 SP4",
"product_id": "SUSE Linux Enterprise Server Teradata 15 SP4:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server Teradata 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:apache-pdfbox"
},
"product_reference": "apache-pdfbox",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-pdfbox-javadoc as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:apache-pdfbox-javadoc"
},
"product_reference": "apache-pdfbox-javadoc",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33929",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33929"
}
],
"notes": [
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.\n\nThis issue affects the \nExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.\n\n\nUsers are recommended to update to version 2.0.37 or 3.0.8 once \navailable. Until then, they should apply the fix provided in GitHub PR \n427.\n\nThe ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. \"/home/ABCDEF\".\n\nUsers who have copied this example into their production code should apply the mentioned change. The example \nhas been changed accordingly and is available in the project repository.",
"title": "CVE description"
}
],
"product_status": {
"known_not_affected": [
"SUSE Linux Enterprise Desktop 15 SP7:apache-pdfbox",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-pdfbox",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-pdfbox",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apache-pdfbox",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP1-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP1:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP2-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP2:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP3-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP3:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP4-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP4:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP5-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP5:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP6:apache-pdfbox",
"SUSE Linux Enterprise Server 15 SP7:apache-pdfbox",
"SUSE Linux Enterprise Server Teradata 15 SP4:apache-pdfbox",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-pdfbox",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-pdfbox",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:apache-pdfbox",
"SUSE Linux Enterprise Server for SAP Applications 15 SP7:apache-pdfbox",
"openSUSE Leap 15.6:apache-pdfbox",
"openSUSE Leap 15.6:apache-pdfbox-javadoc"
],
"recommended": [
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Tumbleweed:apache-pdfbox-2.0.36-1.1",
"openSUSE Tumbleweed:apache-pdfbox-javadoc-2.0.36-1.1"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33929",
"url": "https://www.suse.com/security/cve/CVE-2026-33929"
},
{
"category": "external",
"summary": "SUSE Security Ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "external",
"summary": "SUSE Bug 1262046 for CVE-2026-33929",
"url": "https://bugzilla.suse.com/1262046"
},
{
"category": "external",
"summary": "Advisory link for SUSE-SU-2026:22088-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047309.html"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Tumbleweed:apache-pdfbox-2.0.36-1.1",
"openSUSE Tumbleweed:apache-pdfbox-javadoc-2.0.36-1.1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-2.0.36-160000.1.1",
"SUSE Linux Enterprise Server for SAP applications 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-2.0.36-160000.1.1",
"openSUSE Leap 16.0:apache-pdfbox-javadoc-2.0.36-160000.1.1",
"openSUSE Tumbleweed:apache-pdfbox-2.0.36-1.1",
"openSUSE Tumbleweed:apache-pdfbox-javadoc-2.0.36-1.1"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-14T03:29:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-33929"
}
]
}
Enrichment data
Aggregated bundle (all enrichments)