What is the CVSS score of EUVD-2026-56280?

EUVD-2026-56280 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Content Credentials are affected by EUVD-2026-56280?

Adobe's Content Credentials toolkit contains a path traversal vulnerability in c2patool CLI, c2pa Rust SDK, and @contentauth/c2pa-web JavaScript SDK that enables arbitrary local file system reads…

How to fix or mitigate EUVD-2026-56280?

Within 24 hours, identify and inventory all systems running vulnerable versions of Adobe's Content Credentials components (c2patool ≤v0.27.5, c2pa-rs ≤v0.90.5, @contentauth/c2pa-web ≤v0.12.0) and assess which systems process sensitive content or are exposed to untrusted input. Within 7 days, upgrade all three components to patched versions released by Adobe. Within 30 days, audit file access logs on affected systems to detect unauthorized file access attempts during the vulnerability window and review the scope of potentially exposed sensitive data.

Content Credentials EUVD-2026-56280

| CVE-2026-48442 HIGH

Path Traversal (CWE-22)

2026-08-11 psirt@adobe.com

GHSA-h597-3g4m-44qj

Path Traversal Adobe C2Pa C2Pa Web C2Patool

7.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

Description confirms a file-system read impact (C:H not I:H); scope change reflects cross-boundary traversal; local vector and no-privilege requirement retained from available data.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:23 vuln.today

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.1

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript/WASM SDK - enables arbitrary file-system reads outside intended directory boundaries on the local host. Affected versions include c2patool ≤ v0.27.5, c2pa-rs ≤ v0.90.5, and @contentauth/c2pa-web ≤ 0.12.0, with patched releases available for all three. No public exploit has been identified at time of analysis, but the scope-changed flag in the CVSS vector indicates that successful exploitation can reach resources beyond the vulnerable component's own security domain.

Technical ContextAI

Content Credentials is Adobe's implementation of the C2PA (Coalition for Content Provenance and Authenticity) open specification, which cryptographically embeds signed provenance manifests into media assets. The three affected components - the c2patool CLI (written in Rust), the c2pa Rust SDK, and the @contentauth/c2pa-web JS/WASM SDK - parse C2PA manifests that can reference external resources using file-system paths. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: user-controlled path components within manifest references are not adequately normalized or sandboxed before the runtime resolves them against the host file system. The CVSS S:C (Scope Changed) metric confirms that a successful traversal breaches the application's own security boundary and accesses resources governed by a different security authority, such as OS-level files or adjacent application data.

RemediationAI

Upgrade all affected components to their respective patched releases: c2patool-v0.27.6, c2pa-v0.90.6, and @contentauth/c2pa-web@0.12.1, as documented in Adobe APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. For operators unable to patch immediately, run c2patool or SDK-based services inside a container or chroot environment with a minimal, read-only bind mount limited strictly to the directories the tool legitimately requires, which reduces the accessible blast radius if a traversal is triggered. In CI/CD or media-pipeline contexts, temporarily disable ingestion of externally sourced or untrusted C2PA manifests until patching is complete; the trade-off is loss of automated provenance validation for untrusted content, which is acceptable as a short-term compensating control. No additional vendor-documented workarounds appear in the available references.