CVE-2026-21272CWE-20

CVE-2026-21272

High · published January 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

⚡ A single click could let an attacker write anywhere on your system! In Dreamweaver Desktop versions 21.6 and earlier, improperly validated input can lead to a wild party with your files. 🔥 Think of your computer as a cozy café where the chef (your system) prepares delightful dishes (your files). If a customer (attacker) slips in a bad recipe disguised as a delicious order, they can ruin the menu without anyone noticing until it’s too late! If an unsuspecting user opens a malicious file, the attacker might gain the freedom to manipulate or inject harmful data into critical system files. This could lead to all sorts of chaos, from data corruption to unauthorized access, leaving your café in shambles and vulnerable to even worse threats!

Put simply

Think of your computer as a cozy café where the chef (your system) prepares delightful dishes (your files). If a customer (attacker) slips in a bad recipe disguised as a delicious order, they can ruin the menu without anyone noticing until it’s too late! The vulnerability in Dreamweaver arises from improper validation of user input, which allows attackers to exploit this weakness by providing crafted files that the program inadequately checks, enabling arbitrary file system writes.

What to do

If an unsuspecting user opens a malicious file, the attacker might gain the freedom to manipulate or inject harmful data into critical system files. This could lead to all sorts of chaos, from data corruption to unauthorized access, leaving your café in shambles and vulnerable to even worse threats! To protect yourself, patch Dreamweaver to the latest version as soon as possible. Additionally, educate users about the dangers of opening files from untrusted sources. Regularly audit file permissions to limit the potential damage from any exploitation. You've got this! Stay vigilant and safeguard your system—your hero status is ready to shine! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-01-14T00:16Z
Affected products (1)
ProductVersionsFixed in
adobe/dreamweaver< 21.721.7
References (1)
EPSS history
Timeline
  • 13 JAN 18:25Z
    Dreamweaver Desktop | Improper Input Validation (CWE-20)
    cvelistv5