CVE-2026-48290
published 2026-07-14CVE-2026-48290: CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the…
PriorityP343high8.2CVSS 3.1
AVLACLPRNUIRSCCHIHAN
EPSS
0.18%
7.5th percentile
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | c2pa | <= 0.84.0 | — |
| adobe | c2pa-web | <= 0.7.0 | — |
| adobe | c2patool | <= 0.17.0 | — |
| adobe | content_credentials_command-line_tool | <= c2patool-v0.16.5 | — |
| adobe | content_credentials_js_sdk | <= @contentauth/[email protected] | — |
| adobe | content_credentials_rust_sdk | <= c2pa-v0.84.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe Content Credentials Rust SDK URL server-side request forgery
vuldb·2026-07-15·CVSS 8.2
CVE-2026-48290 [HIGH] Adobe Content Credentials Rust SDK URL server-side request forgery
A vulnerability has been found in Adobe Content Credentials Rust SDK, Content Credentials Command-Line Tool and Content Credentials JS SDK and classified as critical. Affected is an unknown function of the component URL Handler. This manipulation causes server-side request forgery.
This vulnerability is handled as CVE-2026-48290. The attack can be initiated remotely. There is not any exploit available.
GHSA
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user.
ghsa_unreviewed·2026-07-15
CVE-2026-48290 [HIGH] CWE-918 CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user.
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published