Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/pdfbox

              trunk @ 833ed8f
            

Fixes

CVEs

CRITICAL

Peak severity

58.3%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

pdfbox/src/main/java/org/apache/pdfbox/pdmodel/encryption/SecurityHandler.java: most-fixed (5 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XXE: Insecure XML parsing configurations allowed external entity resolution (CVE-2019-0228), which could be exploited via malformed XFDF or stamp files to read local files or conduct SSRF.

Signature Validation Bypass: Failing to mathematically verify that a candidate issuer certificate's public key actually signs a child certificate (instead of trusting matching principal names) allows forged trust chains.

Path Traversal: Failing to canonicalize and strictly validate embedded file paths allowed attackers to write arbitrary files outside the intended destination directory (CVE-2026-33929, CVE-2026-23907).