PyMuPDF versions through 1.28.2 contain a path traversal vulnerability in the font branch of the extract_objects() function. This flaw allows an attacker to craft malicious document files with specially encoded BaseFont names that decode to directory traversal sequences or absolute paths, enabling arbitrary file writes outside the intended output directory without authentication or elevated privileges. The vulnerability was fixed in a commit identified as b2c8f3a.