What is the CVSS score of CVE-2026-48353?

CVE-2026-48353 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

C2PA SDK CVE-2026-48353

EUVD-2026-44517 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-c279-wrgp-v9mg

Information Disclosure Adobe C2Pa C2Pa Web C2Patool

5.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

File-based local vector (AV:L), victim must open file (UI:R), attacker needs no privileges (PR:N); only confidentiality is impacted via arbitrary read (C:H/I:N/A:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:01 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary file system read in Adobe's Content Credentials ecosystem (C2PA Rust SDK, JS SDK, and c2patool CLI) allows an attacker who crafts a malicious C2PA-signed file to access files and directories outside the intended scope when a victim opens that file. The root cause is improper input validation (CWE-20), likely path traversal in manifest or asset reference parsing. No public exploit code exists at time of analysis, EPSS is 0.15% (5th percentile), and CISA SSVC rates exploitation as none - real-world risk is currently contained but the confidentiality impact is rated High given successful arbitrary file read.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is an open standard for embedding cryptographically signed provenance metadata into media files. Adobe ships three affected implementations: the Rust SDK (cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), the JavaScript/Node.js Web SDK (cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and the c2patool command-line tool (cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*). CWE-20 (Improper Input Validation) indicates the SDKs fail to adequately sanitize or constrain file path references embedded within C2PA manifests or ingredient asset references before resolving them on the local file system, enabling path traversal outside the intended working directory.

RemediationAI

Upgrade to the vendor-released patched versions immediately: Rust SDK to c2pa-v0.85.2, JavaScript/Node.js Web SDK to @contentauth/c2pa-web@0.9.0, and the c2patool CLI to c2patool-v0.26.65, as documented in Adobe advisory APSB26-80 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html. Where immediate patching is not possible, restrict processing of C2PA-signed files to trusted, internally generated content only - reject externally sourced or user-supplied C2PA manifests at ingestion boundaries. Running c2patool or SDK-based processes in a sandboxed environment (e.g., read-restricted container with minimal filesystem mounts) limits the blast radius of path traversal by constraining what files are accessible even if the vulnerability is triggered.