Adobe Content Credentials SDK: Path traversal leading to arbitrary file write
Summary
Adobe Content Credentials Rust SDK (c2pa up to v0.91.10) and C2PA Tool (c2patool up to v0.28.5) contain a path traversal flaw (CWE-22). An attacker can write files outside the intended directory, which Adobe describes as arbitrary file system write, and can bypass a security feature. Exploitation requires local access to the system and user interaction, such as a victim opening a malicious file or visiting a crafted page processed by the tool.
Affected
- Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier
- Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier
- All platforms
Fixed in
- Content Credentials Rust SDK: c2pa-v0.91.11
- C2PA Tool: c2patool-v0.28.6
Workaround
Unknown.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-184.
- No public exploit code or CISA KEV entry was found at the time of writing.
Our recommendation
- Update the Rust SDK to c2pa-v0.91.11 and c2patool to c2patool-v0.28.6, prioritising build pipelines and systems that process untrusted files.
- Inventory applications, container images and CI environments that embed the c2pa crate or run c2patool, and check their versions.
- Run the affected tools with least privilege and limit the directories they can write to until patched.
- Do not process untrusted files or URLs with these tools before updating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-184 www.adobe.com
- CVE Record CVE-2026-123267 www.cve.org
- Strix CVE-2026-123267 www.strix.ai
- OffSeq Radar CVE-2026-123267 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:08.
Original description (NVD)
CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.