CVE-2021-28613 Adobe Creative Cloud Arbitrary File Overwrite Vulnerability
An attacker with local admin access can arbitrarily overwrite files in Adobe Creative Cloud Desktop Application via a file handling vulnerability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-28613?
CVE-2021-28613 is a high-severity path traversal vulnerability in Adobe Creative Cloud (desktop component), published on 27 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Adobe Creative Cloud Desktop Application version 5.4 (and earlier) is affected by a file handling vulnerability that could allow an attacker to arbitrarily overwrite a file. Exploitation of this issue requires local access, administrator privileges and user interaction.
Weakness: CWE-379
Which versions are affected by CVE-2021-28613?
It affects 1 product.
Products include Adobe Creative Cloud Desktop Application.
How do I fix CVE-2021-28613?
No fix has been published for CVE-2021-28613 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-28613 being exploited?
There is no known exploitation of CVE-2021-28613 in the wild and no public exploit code.
Other vulnerabilities in Adobe Creative Cloud (desktop component)
- CVE-2020-9671 Privilege escalation in Adobe Creative Cloud Desktop Application
- CVE-2020-9682 Path traversal in Adobe Creative Cloud Desktop Application
- CVE-2020-9670 Path traversal in Adobe Creative Cloud Desktop Application
- CVE-2026-48272 Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-48344 GoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Sources
Also known as GHSA-mm62-qgr2-384q.