Path Traversal Vulnerability in CAI Content Credential by Adobe
CVE-2026-103820

5.5MEDIUM

Key Information:

Vendor

Adobe
Status
Content Credentials Rust Sdk
C2pa Tool
Content Credentials Js Sdk
Vendor
CVE Published:
13 October 2026

What is CVE-2026-103820?

The CAI Content Credential product by Adobe is susceptible to a path traversal vulnerability that permits unauthorized file system writes. This can potentially allow an attacker to manipulate files or directories beyond designated restrictions. Exploitation of this vulnerability necessitates user interaction, requiring a victim to extract a specifically crafted file. Addressing this issue is crucial to maintaining secure file system integrity and preventing unauthorized access or data loss in affected systems.

Affected Version(s)

C2PA Tool 0

Content Credentials JS SDK 0

Content Credentials Rust SDK 0

References

https://www.adobe.com/trust/security/products/content-cre...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.