This vulnerability (CWE-22) in Apache PDFBox Examples affects the ExtractEmbeddedFiles example, which does not correctly restrict file pathnames to a designated directory. The flawed path validation allows a malicious PDF to write files to directories that start with the allowed path prefix but are outside the intended directory (e.g., /home/ABCDEF instead of /home/ABC). The initial fix in versions 2.0.36 and 3.0.7 failed to consider file path separators, leaving the vulnerability exploitable. The project has since updated the example code to properly handle path validation. Users who have copied this example into their own code should apply the fix from GitHub PR 427 or upgrade to the fixed versions when released.

A malicious PDF processed by the vulnerable ExtractEmbeddedFiles example could cause files to be written outside the intended restricted directory, potentially leading to unauthorized file writes in directories with similar path prefixes. This could result in data corruption or unauthorized modification of files in those directories if the user running the code has write permissions there. The vulnerability affects only users who have incorporated the example code into their own production environment.

Users should update to Apache PDFBox version 2.0.37 or 3.0.8 once these versions are available, as they contain the corrected example code. Until then, users who have copied the ExtractEmbeddedFiles example into their own code should apply the fix provided in GitHub PR 427 to properly validate file paths and prevent path traversal. The example code in the official project repository has been corrected accordingly. No other mitigation guidance is provided or necessary.