EUVD-2026-56835
GHSA-wx24-hc73-3hhv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description confirms read-only impact, so I:N and A:N; S:C retained as traversal breaches application sandbox; PR:N and UI:R match file-open requirement.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the victim's local file system by supplying a crafted project or catalog file. The scope-changed CVSS vector (S:C) indicates the vulnerability breaks out of Lightroom's intended file-access sandbox, potentially exposing OS-level files and credentials accessible to the process. No public exploit code has been identified at time of analysis, and Adobe has released a patched version (15.5) via advisory APSB26-94.
Technical ContextAI
CWE-22 (Path Traversal) arises when user-supplied input - in this case a file path embedded in a Lightroom Classic catalog, project, or import manifest - is not canonicalized before being used to resolve file system resources. An attacker embeds directory-traversal sequences (e.g., '../../../') in a crafted file such that Lightroom resolves and reads resources outside its intended working directory. The CVSS local attack vector (AV:L) is consistent with Lightroom being a desktop application that processes files locally; the Scope Changed metric (S:C) confirms that the read can breach the application's own sandbox and reach files owned by or accessible to the OS-level process. Affected CPE implies all Lightroom Classic releases from at least 15.2 through 15.4.1 (including 15.2.1, 15.3, 15.3.1, 15.4).
RemediationAI
The primary fix is upgrading Lightroom Classic to version 15.5, released by Adobe under advisory APSB26-94 at https://helpx.adobe.com/security/products/lightroom/apsb26-94.html. Update via Adobe Creative Cloud desktop application or direct download from Adobe. As a compensating control prior to patching, users should avoid opening Lightroom catalog or project files received from untrusted sources (email attachments, file-sharing links, third-party presets); this directly addresses the UI:R prerequisite. Disabling Lightroom's ability to load catalogs from network shares reduces the attack surface on shared environments. No workaround eliminates the underlying path traversal without patching.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today