Upstream information

CVE-2026-82035 at MITRE

Description

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (VulnCheck) SUSE
Base Score 7.1 7.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Attack Vector Network Network
Attack Complexity Low Low
Privileges Required None None
User Interaction Required Required
Scope Unchanged Unchanged
Confidentiality Impact None None
Integrity Impact High High
Availability Impact Low Low
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
CVSS detail CNA (VulnCheck)
Base Score 7.1
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User Interaction Passive
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact High
Vulnerable System Availability Impact Low
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1280486 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Leap 16.0
  • python313-PyMuPDF >= 1.21.1-lp160.6.1
 Patchnames:
openSUSE-Leap-16.0-leap-17
openSUSE Tumbleweed
  • python313-PyMuPDF >= 1.28.2-1.1
  • python313-PyMuPDF-devel >= 1.28.2-1.1
  • python314-PyMuPDF >= 1.28.2-1.1
  • python314-PyMuPDF-devel >= 1.28.2-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-11824

SUSE Timeline for this CVE

CVE page created: Tue Sep 15 15:45:24 2026
CVE page last modified: Thu Sep 24 16:48:49 2026