CVE-2026-103820CWE-22path-traversal
CVE-2026-103820
Medium · published October 14, 2026
What it is
CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
The record
Technical detail
- CVSS v3.1
- 5.5 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00216 · 11.3th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2026-10-14T02:17Z
Affected products (3)
| Product | Versions | Fixed in |
|---|
| adobe/c2pa | < 0.91.1 | 0.91.1 |
| adobe/c2pa-web | < 0.15.3 | 0.15.3 |
| adobe/c2patool | < 0.28.1 | 0.28.1 |
References (1)
EPSS history
Timeline
15 OCT 03:28Z
EPSS moved — → 0%
epss
13 OCT 21:27Z
CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
cvelistv5
13 OCT 21:27Z
CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
cvelistv5