CISA alerts on PyMuPDF path traversal and arbitrary file write
179th article in the last 90 days, one of 517 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on CASL Ability prototype pollution in 2.4.0–6.7.4 (Feb 2026).
Companies mentioned
Best suited for
- Job function
- Application / Software Development
- Seniority
- Staff
- Persona
- Security Operations Practitioner
- Buyer role
- Technical Implementer / Administrator
- Buyer journey
- Post Buy
- Adoption curve
- Early Majority
- Industry
- Information Technology / Software & Services / IT Services / Internet Services & Infrastructure
Our classification, not the publisher's statement. Best suited for, not only for.
PyMuPDF version 1.26.5 contains a path traversal vulnerability in its embedded_get routine that can allow arbitrary file writes to locations on the local system.
PyMuPDF, the Python interface to the MuPDF rendering engine, exposes the issue in the embedded_get function located in __main__.py. If a user does not supply args.output, embedded_get falls back to embedded-file metadata (for example the file name) and opens that derived path in write-binary mode; write-binary mode in this context performs no safety checks. A crafted PDF can supply a name that targets a location on the local filesystem, and when an embedded file is extracted using embedded_get without a specified args.output the tool can write the extracted content outside the intended directory. The advisory identifies the affected release as version 1.26.5 and the remedial release as version 1.26.7.
Successful exploitation can result in arbitrary file writing to locations permitted by the executing user. If performed under an account with elevated privileges, the write operation may overwrite system files. The advisory states this could lead to privilege escalation, service disruption, or security bypass.
PyMuPDF has released version 1.26.7 to address this vulnerability. Affected users are encouraged to update as soon as possible.
The advisory notes one or more vendors are listed and directs readers to the full report for vendor details and references; it also cites the project repository and a specific commit. Acknowledgements in the document credit the reporter UKO and attribute the write-up to Michael Bragg.
Blog post, originally published by Michael Bragg at kb.cert.org.