The fix, in one snippet
pdfdetach -list file.pdfIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner locates /EmbeddedFile streams, the /EmbeddedFiles name tree and /FileAttachment annotations, and for each attachment records the declared name and size, decompresses the stream where possible and runs the same magic-byte identification used for top-level files. An executable, script or archive inside the PDF is also reported under embedded executable. JavaScript that calls exportDataObject (which writes the attachment to disk) or a /Launch action pointing at the attachment raises the severity. Limits: attachments with unusual filters are listed but not identified; PDF portfolios legitimately bundle many files, and some e-invoice standards (ZUGFeRD, Factur-X) embed an XML file by design.
Why it matters
An attachment turns the PDF into a container: the outer document passes as a document, the payload rides inside. Readers let you open attachments with a double-click; Acrobat blocks some dangerous types by default but not all, and older or third-party readers block fewer. A common evasion is a PDF inside a PDF, where the inner file carries the JavaScript or action and a scanner that does not recurse sees a clean outer file. Users of desktop readers and mail gateways that do not unpack attachments are the ones affected, and so is anyone who forwards the PDF onward without knowing what it carries.
How to fix it
Do not open attachments from inside the reader. If you need them, extract with poppler's pdfdetach into a sandbox and scan each one separately with the file scanner:
$ pdfdetach -list bundle.pdf
1: invoice_details.exe
$ pdfdetach -saveall -o ./extracted bundle.pdfIn Acrobat, Trust Manager controls which attachment types may open. Browser viewers show attachments in a sidebar but do not run them. Guides: malicious PDF files and is this file safe?
Where this fits
PDF contains embedded files is check 17 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Executable program file (medium), where the file is an executable program (Windows PE, macOS Mach-O, Linux ELF, an installer or a script) that will run with your privileges if opened. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
PDF contains embedded files closes one route in. Immediately below it: Password-protected archive, where the archive's contents are encrypted with a password, so neither Scan.now nor your antivirus can inspect what is inside before you extract it; EICAR antivirus test file, where the file contains the EICAR test string, a harmless sequence that every antivirus engine is required to detect; File hash reputation, where scan.now computed the file's SHA-256 (plus MD5 and SHA-1 for comparison with older feeds) and compared it with the hash lists it holds; this entry explains what a match or a miss means.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: PDF contains embedded files (medium severity)
Scanner check id: pdf-embedded-fileThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 11, 2026
Malicious PDF Files: How a Document Runs Code and How to Check One
PDFs can carry JavaScript, launch actions, embedded files and exploits for the reader itself. The structures attackers use, the signals...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide