What is the CVSS score of EUVD-2026-13117?

EUVD-2026-13117 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-13117?

Within 7 days: Identify all affected systems running PyMuPDF and apply vendor patches promptly. Monitor vendor channels for patch availability.

PyMuPDF EUVD-2026-13117

Q: Which versions of PyMuPDF are affected by EUVD-2026-13117?

Organizations using PyMuPDF face notable risk from CVE-2026-3029 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

| CVE-2026-3029 HIGH

Path Traversal (CWE-22)

2026-03-19 certcc

GHSA-cxqh-p2w9-fmr7

Path Traversal PyMuPDF

7.5

CVSS 3.1 · Vendor: certcc

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send malicious PDF with traversal path
Exploit

PyMuPDF parses embedded get function
Execution

Write arbitrary file to system
Impact

Cause denial of service via resource exhaustion

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against PyMuPDF versions up to 1.26.5 via the embedded get function in _main_.py. Attacker can trigger arbitrary file write through path traversal.
Impact	Sensitive files such as configuration files, credentials, or system files can be read, potentially leading to further compromise.
Exploit ScenarioDerived	An attacker modifies a file parameter to include directory traversal sequences (../../etc/passwd) to read arbitrary files from the server filesystem.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 19, 2026

PyMuPDF versions up to 1.26.5 allow unauthenticated remote attackers to write arbitrary files to the system through path traversal in the embedded get function. This vulnerability enables denial of service attacks and potential system compromise without requiring authentication or user interaction. No patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 19, 2026 - 16:00 CVSS 7.5

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

Affected VersionsENISA

PyMuPDF 1.26.5 <1.26.7

Affected Packages

pypi pymupdf fix: 1.26.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE HIGH

Red Hat 8.2 HIGH

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 19, 2026 - 15:53 nvd

HIGH 7.5

DescriptionCVE.org

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 pypi packages depend on pymupdf (8 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.26.5.

Executive ViewAI

Why It Matters

Organizations using PyMuPDF face notable risk from CVE-2026-3029 rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.