Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligencePYSEC-2026-3001

PYSEC-2026-3001

HIGH8.0

PYSEC-2026-3001

Published Jul 13, 2026

Modified 1 months ago

Fix available

Details

A path traversal and arbitrary file write vulnerability exist in the embedded get function in 'main.py' in PyMuPDF version, 1.26.5.

Affected Packages

pymupdf

PyPI

Affected versions:

1.26.51.26.6

Fixed in:

1.26.7

References

http://github.com/pymupdf/PyMuPDF

http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a

https://github.com/advisories/GHSA-cxqh-p2w9-fmr7

https://github.com/pymupdf/PyMuPDF

https://nvd.nist.gov/vuln/detail/CVE-2026-3029

https://pypi.org/project/pymupdf

https://www.kb.cert.org/vuls/id/504749

Aliases

CVE-2026-3029 GHSA-cxqh-p2w9-fmr7

CVSS Analysis

CVSS v4.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Related

Ecosystems

Timeline

PublishedJul 13, 2026

ModifiedJul 13, 2026

PYSEC-2026-3001 | Mondoo Vulnerability Intelligence