EUVD-2026-44388
GHSA-qq67-g2p8-3v54
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Remote unauthenticated file read needing no interaction (AV:N/AC:L/PR:N/UI:N); reads escape the component's scope (S:C) disclosing sensitive files (C:H) with no integrity or availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenticated attackers traverse outside the intended directory scope to retrieve sensitive files, per Adobe advisory APSB26-74. The CVSS 3.1 score of 8.6 is elevated by a changed scope (S:C), meaning the read reaches resources beyond the vulnerable component's security authority. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
Adobe Experience Manager is a Java/OSGi-based enterprise content management and digital experience platform, deployed both as a managed cloud service and as on-premises/AMS installations (6.5 and the 6.5 Long Term Support release). The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), in which user-controllable path input is not adequately canonicalized or constrained, allowing sequences such as '../' to escape an intended base directory. Because AEM front-ends content via HTTP endpoints (Sling/dispatcher request handling), a crafted request path or parameter can be resolved against the server filesystem, yielding reads of files outside the web application's intended tree.
RemediationAI
Patch available per vendor advisory (Adobe APSB26-74): apply the fixed Service Pack/hotfix for your AEM channel - the managed AEM as a Cloud Service should receive the fix through Adobe's release pipeline, while AEM 6.5 and 6.5 LTS require installing the corresponding Adobe-published Service Pack; the exact fixed version is not stated in the available data, so confirm it against https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html. Until patched, compensating controls include tightening AEM Dispatcher filter rules to allow only known-good paths and reject requests containing traversal sequences or encoded '../', and restricting direct network exposure of author/publish instances behind a WAF with path-normalization and traversal-blocking rules (trade-off: overly strict Dispatcher rules can break legitimate content delivery and require testing against your site's URL patterns). Do not rely on workarounds as a permanent fix, since path-traversal filters are frequently bypassable via alternate encodings.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today