—

PYSEC-2026-3001

PyMuPDF has a path traversal in _main_.py

Quick fix

PYSEC-2026-3001 — pymupdf: upgrade to the fixed version with the command below.

pip install --upgrade 'pymupdf>=1.26.7'

Details

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 1.26.5Fixed in: 1.26.7

Fixpip install --upgrade 'pymupdf>=1.26.7'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-3029[ADVISORY]
https://github.com/pymupdf/PyMuPDF[PACKAGE]
https://www.kb.cert.org/vuls/id/504749[WEB]
http://github.com/pymupdf/PyMuPDF[WEB]
http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a[WEB]
https://pypi.org/project/pymupdf[PACKAGE]
https://github.com/advisories/GHSA-cxqh-p2w9-fmr7[ADVISORY]