EUVD-2026-44436
GHSA-6qvq-7gfm-32m8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local file-parsing bug needs no attacker privileges (PR:N) but requires the victim to open a crafted file (AV:L, UI:R); traversal crosses a boundary (S:C) yielding full code execution (C/I/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation risk hinges on social-engineering a user into opening a rogue project file.
Technical ContextAI
Adobe Animate is a desktop authoring/animation tool that parses proprietary and imported asset file formats (e.g., .fla/.xfl project files and embedded media). The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): during file parsing the application resolves an attacker-controlled pathname (likely containing sequences such as ../ or absolute paths) without sufficient canonicalization or sandboxing, allowing references to escape the intended working directory. Because the CVSS scope is marked Changed (S:C), the traversal lets the impact cross a trust/security boundary - here escalating a file-handling parsing bug into arbitrary code execution in the current user's context. Affected builds per Adobe CPE data are cpe:2.3:a:adobe:adobe_animate_2023 and cpe:2.3:a:adobe:adobe_animate_2024.
RemediationAI
Apply the update referenced in Adobe Security Bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html); patch available per vendor advisory, though the exact fixed version is not enumerated in the input data, so confirm the target build directly from the bulletin. Update Adobe Animate 2023 and 2024 to the versions Adobe designates as fixed, ideally via the Creative Cloud desktop app or managed enterprise deployment. Until patched, the primary compensating control is user-behavior and content hygiene: do not open Animate project or asset files (.fla/.xfl and imported media) from untrusted or unsolicited sources, and route inbound design files through a review/sandbox host rather than production workstations - the trade-off is added friction for teams that routinely exchange files with external partners. Where feasible, run Animate under a least-privilege user account to limit the blast radius of code executing in the current user's context, accepting the operational overhead of non-administrator design workflows.
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that le
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the curr
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today