EUVD-2026-49949
GHSA-x7vg-5fch-cgr8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attack vector requiring user interaction; low complexity; high impact on confidentiality, integrity, and availability.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Technical ContextAI
Adobe Bridge is a digital asset management application that handles various file types; it suffers from an Improper Limitation of a Pathname to a Restricted Directory (CWE-22). The vulnerability likely arises from insufficient sanitization of file paths embedded in project or asset files, enabling traversal sequences like '../' to escape the intended directory scope. According to CPE data, all versions of Adobe Bridge for all platforms are affected.
RemediationAI
Update Adobe Bridge to the latest patched version provided in Adobe Security Bulletin APSB26-89. If immediate patching is not possible, avoid opening untrusted files in Bridge, and consider restricting Bridge's file system access through OS-level permissions or running it in a sandboxed environment. Disabling automatic file preview or restricting use to trusted file sources reduces exposure, but these measures do not eliminate the underlying flaw.
More in Adobe Bridge
View allArbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerabil
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows
Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the contex
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a malic
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-o
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerabilit
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by ent
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the c
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim op
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today