What is the CVSS score of CVE-2026-3029?

CVE-2026-3029 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PyMuPDF are affected by CVE-2026-3029?

Organizations using PyMuPDF face notable risk from CVE-2026-3029 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-3029?

Within 7 days: Identify all affected systems running PyMuPDF and apply vendor patches promptly. Monitor vendor channels for patch availability.

PyMuPDF CVE-2026-3029

EUVD-2026-13117 HIGH

Path Traversal (CWE-22)

2026-03-19 certcc

GHSA-cxqh-p2w9-fmr7

Path Traversal PyMuPDF

7.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 16:00 euvd

EUVD-2026-13117

Analysis Generated

Mar 19, 2026 - 16:00 vuln.today

CVE Published

Mar 19, 2026 - 15:53 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 pypi packages depend on pymupdf (7 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.26.5.

DescriptionCVE.org

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.

AnalysisAI

PyMuPDF versions up to 1.26.5 allow unauthenticated remote attackers to write arbitrary files to the system through path traversal in the embedded get function. This vulnerability enables denial of service attacks and potential system compromise without requiring authentication or user interaction. No patch is currently available.