CVE-2026-3029
Fixed in a distro release EPSS <1%CVSS 7.5
A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.
Products: Artifex Software Inc. *PyMuPDF* PyMuPDF, Red Hat Enterprise Linux AI (RHEL AI) 3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pymupdf | 1.26.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pymupdf | no fix |
| Debian 13 | pymupdf | 1.25.4+ds1-3+deb13u1 |
| Debian 14 | pymupdf | 1.26.7+ds1-1 |
| Ubuntu 20.04 LTS | pymupdf | no fix |
| Ubuntu 22.04 LTS | pymupdf | no fix |
| Ubuntu 24.04 LTS | pymupdf | no fix |
| Ubuntu 25.10 | pymupdf | no fix |
| openSUSE Tumbleweed | python-PyMuPDF | 1.27.2.2-1.1 |