Skip to content
AdobeCVE-2026-48446

Adobe Content Credentials: path traversal

Medium5.5CVE-2026-48446 · Published Aug 11, 2026 · updated Aug 28, 2026

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Adobe advisory

Affected versions

PackageAffectedFixed in
Content Credentials Command-Line Tool
Product
<= c2patool-v0.27.5No fix yet
Content Credentials JS SDK
Product
<= @contentauth/c2pa-web@0.12.0No fix yet
Content Credentials Rust SDK
Product
<= c2pa-v0.90.5No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More Adobe advisories

All Adobe
Advisory
Adobe Campaign Classic: improper authorization
Critical10.0Aug 11
Adobe Commerce: improper authorization
Critical9.1Aug 11
Adobe Lightroom Classic: improper authorization
High7.7Aug 11
Adobe Lightroom Classic: path traversal
High8.6Aug 11
Adobe Commerce: cross-site scripting
High8.7Aug 11
Adobe Commerce: cross-site scripting
High7.7Aug 11

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.