CVE-2026-48442Disclosure(adobe / c2pa)

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.

adobe CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

c2pa
c2pa-web
c2patool

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

adobe

Products

c2pac2pa-webc2patool

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-48442/

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Disclosure
CVE-2026-48442 - Path traversal in CAI Content Credentials allows arbitrary file system read. CVSS 7.1. No user interaction needed. Patch status unknown. Update immediately. #CVE #infosec #CAI https://www.valtersit.com/cve/CVE-2026-48442/ #infosec #CVE #infosec #SysAdmin #cybersecurity #Linux #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta
Post summary
A newly reported CVE‑2026‑48442 permits arbitrary file system reads via a path traversal in CAI Content Credentials, rated CVSS 7.1 and requiring no user interaction, but the patch status remains unknown.
0000079
1.0K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Disclosure
CVE-2026-48442 - Path traversal in CAI Content Credentials allows arbitrary file system read. CVSS 7.1. No user interaction needed. Patch status unknown. Update immediately. #CVE #infosec #CAI https://www.valtersit.com/cve/CVE-2026-48442/ #infosec #CVE #infosec #SysAdmin #cybersecurity #Linux #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta
Post summary
This post announces CVE‑2026‑48442, a path traversal flaw in CAI Content Credentials that permits arbitrary file system reads (CVSS 7.1) without user interaction. Patch status is unknown and no evidence of active exploitation or PoC is provided.
0000074
1.0K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	c2pa	-	rust	-
App	adobe	c2pa-web	-	node.js	-
App	adobe	c2patool	-	-	-

Explore more

Back to dashboard adobe CVEs c2pa vulnerabilities