What is GHSA-cxqh-p2w9-fmr7?

GHSA-cxqh-p2w9-fmr7 is a security advisory published by GitHub Security Advisories with Medium severity. PyMuPDF has a path traversal in _main_.py

Which CVE IDs does GHSA-cxqh-p2w9-fmr7 cover?

GHSA-cxqh-p2w9-fmr7 covers the following CVE IDs: CVE-2026-3029. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-cxqh-p2w9-fmr7?

GHSA-cxqh-p2w9-fmr7 affects 1 product, including: pip/PyMuPDF:\u003e= 1.26.5, \u003c 1.26.7.

GHSA-cxqh-p2w9-fmr7Medium

PyMuPDF has a path traversal in _main_.py

Vendor

GitHub Security Advisories

Published

March 19, 2026

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-3029 →

📋 Description

A path traversal and arbitrary file write vulnerability exist in the embedded get function in 'main.py' in PyMuPDF version, 1.26.5.

🎯 Affected products1

pip/PyMuPDF:>= 1.26.5, < 1.26.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-3029
https://www.kb.cert.org/vuls/id/504749
http://github.com/pymupdf/PyMuPDF
http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a
https://github.com/advisories/GHSA-cxqh-p2w9-fmr7