All vulnerabilities
CVE-2026-103820

CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Content Credentials Rust SDK
Open in ThreatlineRecord JSON
CVSS
5.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.

Text from CVE List

Affected versions 6

  • Content Credentials Rust SDKaffected: all versions through c2pa-v0.90.15CVE List
  • Content Credentials Rust SDKunaffected: c2pa-v0.91.1CVE List
  • C2PA Toolaffected: all versions through c2patool-v0.27.15CVE List
  • C2PA Toolunaffected: v0.28.1CVE List
  • Content Credentials JS SDKaffected: all versions through @contentauth/c2pa-web@0.13.4CVE List
  • Content Credentials JS SDKunaffected: @contentauth/c2pa-web@0.15.3CVE List

References 1