Apache PDFBox vulnerabilities

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, allowing context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.36 and 3.0.0–3.0.7) contains a path traversal vulnerability (CWE-22). The fix in 2.0.36 and 3.0.7 is flawed because it does not consider the file path separator, allowing writes to paths starting with the user's directory, e.g. /home/ABCDEF.

The ExtractEmbeddedFiles example in Apache PDFBox (versions 2.0.24–2.0.35 and 3.0.0–3.0.6) has a path traversal vulnerability (CWE-22) because the filename from PDComplexFileSpecification.getFilename() is appended to the extraction path without validation.