CVE-2026-103820

Undergoing Analysis Undergoing Analysis - In Progress

CAI Content Credential Path Traversal Vulnerability

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103820

EUVD

EUVD-2026-100714

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	c2pa	to 0.91.1 (exc)
adobe	c2pa-web	to 0.15.3 (exc)
adobe	c2patool	to 0.28.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a Path Traversal issue in CAI Content Credential. It allows an attacker to write files to unauthorized directories outside intended restrictions by exploiting improper pathname limitations. Exploitation requires user interaction, such as extracting a maliciously crafted file.

Detection Guidance

Detection involves checking for unauthorized file writes or suspicious file extraction activities. Monitor logs for unexpected file operations in restricted directories. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to write malicious files to your system, potentially overwriting important files, installing malware, or gaining unauthorized access. This could lead to data corruption, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing sensitive data or violating data integrity. This may result in non-compliance with GDPR (data protection) or HIPAA (health data security) due to unauthorized access or data breaches.

Mitigation Strategies

Update the affected Adobe Content Credential SDKs to the latest patched versions. Avoid extracting files from untrusted sources. Implement strict file system access controls.

Hi! I’m here to help you understand CVE-2026-103820. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70