CVE-2026-3029

HIGH

PyMuPDF 1.26.5 - Path Traversal and Arbitrary File Write

Title source: manual

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.

Core 6

Core References

Third Party Advisory, US Government Resource

Vendor Advisory

Vendor Advisory

Vendor Advisory

CVSS v3 7.5

EPSS 0.0035

EPSS Percentile 27.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

CWE

CWE-22

Status published

Products (2)

Artifex Software Inc. *PyMuPDF*/PyMuPDF 1.26.5 - 1.26.7

pypi/PyMuPDF 1.26.5 - 1.26.7PyPI

Published Mar 19, 2026

Tracked Since Mar 19, 2026