GitHub Advisoryadvisory · PyPI

GHSA-cxqh-p2w9-fmr7 PyMuPDF has a path traversal in _main_.py

MEDIUM Published 2026-03-19 Modified 2026-03-19 Official page ↗

Aliases: CVE-2026-3029
Ecosystem: PyPI
Packages: PyMuPDF
Severity: Moderate
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-22
Reviewed: 2026-03-19

Affected packages

• PyPI PyMuPDF: >= 1.26.5, < 1.26.7 → fixed in 1.26.7

Description

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.

Related

Alias · CVE (1)

CVE-2026-3029 A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5. vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References