CVE-2026-34657
published 2026-06-09CVE-2026-34657: CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path…
PriorityP428medium5.5CVSS 3.1
AVLACLPRNUIRSUCNIHAN
EPSS
0.18%
7.5th percentile
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | c2pa | <= 0.80.1 | — |
| adobe | c2pa-web | <= 0.7.1 | — |
| adobe | content_credentials_js_sdk | <= @contentauth/[email protected] | — |
| adobe | content_credentials_rust_sdk | <= c2pa-v0.80.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe CAI Content Credentials path traversal (apsb26-61)
vuldb·2026-08-29·CVSS 5.5
CVE-2026-34657 [MEDIUM] Adobe CAI Content Credentials path traversal (apsb26-61)
A vulnerability described as critical has been identified in Adobe CAI Content Credentials. This issue affects some unknown processing. Such manipulation leads to path traversal.
This vulnerability is listed as CVE-2026-34657. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could res
ghsa_unreviewed·2026-06-10
CVE-2026-34657 [MEDIUM] CWE-22 CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could res
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-09
Published