Hi,

The following vulnerability was published for pymupdf.

CVE-2026-82035[0]:
| PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path
| traversal vulnerability in the font branch of extract_objects() in
| src/__main__.py, where the output filename is constructed by joining
| a document-controlled BaseFont name directly onto the user-supplied
| output directory without stripping path separators or dot-dot
| sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2
| file with a BaseFont name containing encoded path separators that
| decode to ../ sequences or absolute paths, causing arbitrary file
| writes outside the intended output directory without requiring
| authentication or elevated privileges.

Fixed by: https://github.com/pymupdf/PyMuPDF/commit/b2c8f3a859fed35c379a44df566f770dc3e18605


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-82035
https://www.cve.org/CVERecord?id=CVE-2026-82035

Please adjust the affected versions in the BTS as needed.