CVE-2026-48442

Analyzed Analyzed - Analysis Complete

Path Traversal in CAI Content Credentials

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: Adobe Systems Incorporated

Description

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48442

EUVD

EUVD-2026-56280

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	c2pa	to 0.90.6 (exc)
adobe	c2pa-web	to 0.12.1 (exc)
adobe	c2patool	to 0.27.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CAI Content Credentials has an Improper Limitation of a Pathname to a Restricted Directory vulnerability, also known as Path Traversal. This allows an attacker to read arbitrary files on the system outside intended restrictions without needing user interaction.

Detection Guidance

This vulnerability involves path traversal in CAI Content Credentials. Detection requires checking for improper path restrictions in file system access. Review application logs for unusual file access patterns or requests containing sequences like '../' or '..\'. Inspect configuration files for path validation logic. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to read sensitive files on your system, potentially accessing confidential data, configuration files, or other restricted information. Since no user interaction is required, the risk is higher as exploitation can occur silently.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Apply the latest security patches or updates from Adobe for CAI Content Credentials to address the path traversal vulnerability. Ensure proper input validation and restrict file system access to authorized directories only.

Hi! I’m here to help you understand CVE-2026-48442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70