CVE-2026-48310
published 2026-07-14CVE-2026-48310: Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to…
PriorityP356high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.55%
42.5th percentile
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager_6.5 | <= 6.5.25 | — |
| adobe | adobe_experience_manager_6.5_lts | <= SP2 | — |
| adobe | adobe_experience_manager_as_a_cloud_service | <= 2026.5.0 | — |
| adobe | experience_manager | <= 6.5.25.0 | — |
| adobe | experience_manager | <= 2020.5.0 | — |
| adobe | experience_manager | — | — |
| adobe | experience_manager | — | — |
| adobe | experience_manager | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe Experience Manager File System Access pathname path traversal (Nessus ID 327021)
vuldb·2026-07-16·CVSS 8.6
CVE-2026-48310 [HIGH] Adobe Experience Manager File System Access pathname path traversal (Nessus ID 327021)
A vulnerability labeled as problematic has been found in Adobe Experience Manager. This issue affects some unknown processing of the component File System Access. Executing a manipulation of the argument pathname can lead to path traversal.
This vulnerability is handled as CVE-2026-48310. The attack can be executed remotely. There is not any exploit available.
GHSA
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.
ghsa_unreviewed·2026-07-14
CVE-2026-48310 [HIGH] CWE-22 Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published