CVE-2026-34657

Summary

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.

Affected Software

VendorProductVersion RangeStatus
AdobeContent Credentials Rust SDK0 <= c2pa-v0.80.1affected
AdobeContent Credentials Rust SDKc2pa-v0.85.1unaffected
AdobeContent Credentials JS SDK0 <= @contentauth/c2pa-web@0.7.1affected
AdobeContent Credentials JS SDK@contentauth/c2pa-web@0.8.3unaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References