[jira] [Commented] (PDFBOX-6180) Improve directory boundary check in ExtractEmbeddedFiles example

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PDFBOX-6180?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18067440#comment-18067440 ] 

ASF subversion and git services commented on PDFBOX-6180:
---------------------------------------------------------

Commit 1932443 from Tilman Hausherr in branch 'pdfbox/branches/3.0'
[ https://svn.apache.org/r1932443 ]

PDFBOX-6180: improve directory boundary check, as suggested by Kaixuan Li; closes #427

> Improve directory boundary check in ExtractEmbeddedFiles example
> ----------------------------------------------------------------
>
>                 Key: PDFBOX-6180
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-6180
>             Project: PDFBox
>          Issue Type: Improvement
>          Components: Utilities
>    Affects Versions: 2.0.36, 3.0.7 PDFBox
>            Reporter: Tilman Hausherr
>            Assignee: Tilman Hausherr
>            Priority: Major
>             Fix For: 2.0.37, 3.0.8 PDFBox, 4.0.0
>
>
> Kaixuan Li showed a flaw in the commit for CVE-2026-23907 and a solution.
> The flaw is that if we have writing rights on {{/home/Jona}} then the software could create a malicious PDF that extracts to any users that start with {{/home/Jon}} e.g. {{/home/Jonathan}} (if we'd have writing rights there).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org