What is the CVSS score of CVE-2026-48290?

CVE-2026-48290 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Content Credentials are affected by CVE-2026-48290?

The Adobe C2PA SDK family-a content credential validation library deployed in media, publishing, and digital asset management applications-contains a flaw enabling remote code execution through…

How to fix or mitigate CVE-2026-48290?

Within 24 hours: Inventory all internal applications and third-party solutions using Adobe C2PA SDK components (c2pa, c2pa-web, c2patool) and document their criticality; disable non-essential asset validation workflows where feasible. Within 7 days: Deploy network controls restricting outbound connections from systems running C2PA applications, establish log monitoring for suspicious validation requests and script injection attempts, and subscribe to Adobe security advisories for patch announcements. Within 30 days: Develop and test migration plans for patched SDK versions once released, and evaluate alternative content credential validation solutions if Adobe's patch timeline extends beyond your risk tolerance.

Content Credentials CVE-2026-48290

EUVD-2026-44527 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 psirt@adobe.com

GHSA-5j74-v2xh-7cpv

RCE SSRF C2Pa C2Pa Web C2Patool

8.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Local processing of attacker-supplied content with required user interaction (AV:L, UI:R, PR:N); scope changes into the user session (S:C) with high confidentiality and integrity impact and no availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:33 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 8.2

DescriptionCVE.org

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK (c2pa-web), and the c2patool CLI - can escalate to arbitrary code execution in the context of the current user. When an application built on these libraries validates a maliciously crafted asset or URL, the SSRF is chained into script injection to hijack the victim's session or account. No public exploit has been identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is the open standard implemented by Adobe's Content Credentials tooling to embed and verify cryptographically signed provenance manifests inside media files. The affected components are the Rust reference SDK (cpe:2.3:a:adobe:c2pa, rust), the JavaScript/Node.js binding c2pa-web (cpe:2.3:a:adobe:c2pa-web, node.js), and the c2patool command-line utility (cpe:2.3:a:adobe:c2patool). The root cause is CWE-918 (Server-Side Request Forgery): when the manifest/validation logic resolves an attacker-controlled reference (for example a remote manifest or ingredient URL) it issues an outbound request without adequate validation, which per the advisory can be chained into script injection and code execution in the current user's context. The CVSS vector's AV:L with S:C indicates the untrusted fetch/processing occurs in a locally invoked verification workflow but crosses a security boundary (scope change) into the user's session or host.

RemediationAI

Vendor-released patches are available - upgrade the Rust SDK to c2pa-v0.85.2, the Node.js web SDK to @contentauth/c2pa-web@0.9.0, and the command-line tool to c2patool-v0.26.65, per Adobe advisory APSB26-80 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html). Because these are libraries, also rebuild and redeploy any downstream application, service, or browser bundle that vendors an affected version, and audit transitive dependencies for pinned older releases. Where immediate upgrade is not possible, avoid processing Content Credentials manifests from untrusted sources and restrict outbound network access from the verification process so SSRF-triggered fetches cannot reach internal or cloud-metadata endpoints (egress allowlisting or blocking link-local/RFC1918 targets) - the trade-off is that legitimate remote-manifest resolution will break. For c2pa-web deployments, apply a strict Content-Security-Policy to blunt the script-injection step, accepting that CSP does not address the underlying SSRF.