CVE-2026-48446

Analyzed Analyzed - Analysis Complete

Path Traversal in CAI Content Credentials

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: Adobe Systems Incorporated

Description

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48446

EUVD

EUVD-2026-56275

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	c2pa	to 0.90.6 (exc)
adobe	c2pa-web	to 0.12.1 (exc)
adobe	c2patool	to 0.27.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CAI Content Credentials has a Path Traversal vulnerability allowing attackers to read arbitrary files on the system by tricking users into visiting a malicious URL or interacting with a compromised page. Exploitation requires user interaction.

Detection Guidance

Detection of this Path Traversal vulnerability in CAI Content Credentials would typically involve monitoring for unusual file access patterns or requests to restricted directories. Check web server logs for suspicious URL patterns containing sequences like '../' or encoded equivalents. Inspect network traffic for unexpected file reads from sensitive directories. No specific commands are provided in the context.

Impact Analysis

An attacker could access sensitive files or directories on your system, potentially stealing confidential data like documents, credentials, or configuration files. This could lead to data breaches or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties or compliance violations.

Mitigation Strategies

Immediate mitigation steps include applying the latest security patches or updates from Adobe for CAI Content Credentials. Restrict user permissions to minimize access to sensitive directories. Implement input validation for URLs to prevent path traversal sequences. Monitor for unusual file access and update web server configurations to block malicious patterns.

Hi! I’m here to help you understand CVE-2026-48446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70