Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceGHSA-cxqh-p2w9-fmr7

GHSA-cxqh-p2w9-fmr7

MEDIUM6.9

PyMuPDF has a path traversal in _main_.py

Published Mar 19, 2026

Modified 6 months ago

Fix available

Details

A path traversal and arbitrary file write vulnerability exist in the embedded get function in 'main.py' in PyMuPDF version, 1.26.5.

Affected Packages

PyMuPDF

PyPI

Fixed in:

1.26.7

References

http://github.com/pymupdf/PyMuPDF

http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a

https://github.com/advisories/GHSA-cxqh-p2w9-fmr7

https://github.com/pymupdf/PyMuPDF

https://nvd.nist.gov/vuln/detail/CVE-2026-3029

https://www.kb.cert.org/vuls/id/504749

Aliases

CVSS Analysis

CVSS v4.0

6.9

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.9/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Related

Ecosystems

Timeline

PublishedMar 19, 2026

ModifiedMar 19, 2026

GHSA-cxqh-p2w9-fmr7 | Mondoo Vulnerability Intelligence