Content Credentials SDK CVE-2026-103820

Exploitation requires a victim to extract or process a maliciously crafted Content Credentials file using one of the affected components (the c2patool CLI, the c2pa Rust SDK, or the @contentauth/c2pa-web JS SDK). The limiting factors are significant: the attack vector is local (AV:L), so the malicious file must reach and be opened on the target system, and user interaction is mandatory (UI:R) - the vulnerability cannot trigger without the victim actively extracting the crafted asset. No attacker authentication is required (PR:N). Exposure is confined to systems and applications that use these SDKs/tool to handle untrusted C2PA assets; environments that only produce or verify trusted, first-party content are not realistically exposed.

This is a moderate-severity path traversal (CWE-22) enabling arbitrary file write, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.5) correctly reflects a local attack vector that requires victim user interaction - the victim must extract a maliciously crafted file - which caps real-world severity well below a remote-code-execution emergency. PR:N means no attacker authentication is needed, but the UI:R and AV:L constraints mean this cannot be exploited remotely or automatically; it depends on social-engineering a user into processing an attacker-supplied file through the vulnerable tooling. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The affected components are developer SDKs and a CLI tool (c2patool, the C2PA Rust SDK, and the Content Credentials JS SDK), so exposure is scoped to applications and pipelines that build on these libraries to process untrusted Content Credentials assets. Net: a legitimate issue to patch on a normal cadence, not a drop-everything priority - the I:H write primitive could be chained toward code execution (e.g., overwriting a config or startup file), but the local+UI prerequisites keep realistic risk at moderate.

An attacker crafts a malicious Content Credentials asset or archive containing path-traversal sequences in embedded file paths and distributes it (e.g., via a shared media file or supply-chain artifact). When a victim extracts or processes that file using c2patool or an application built on the affected C2PA SDKs, the tool writes attacker-controlled content to a location outside the intended directory. No public proof-of-concept was identified in the provided data.