Adobe CAI Content Credentials Path Traversal -> arbitrary FS read
CVE-2026-48442 Published on August 11, 2026
CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.
Vulnerability Analysis
CVE-2026-48442 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-48442 has been classified to as a Directory traversal vulnerability or weakness.
Affected Versions
Adobe Content Credentials Rust SDK:- Before and including c2pa-v0.90.5 is affected.
- Version c2pa-v0.90.6 is unaffected.
- Before and including c2patool-v0.27.5 is affected.
- Version c2patool-v0.27.6 is unaffected.
- Before and including @contentauth/c2pa-web@0.12.0 is affected.
- Version @contentauth/c2pa-web@0.12.1 is unaffected.