CVE-2021-40745 Adobe Campaign Path Traversal Leads to Information Exposure
An unauthenticated attacker can exploit a path traversal vulnerability in Adobe Campaign to read arbitrary server files and enumerate directory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40745?
CVE-2021-40745 is a high-severity path traversal vulnerability in Adobe Campaign, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.
Weakness: CWE-22
Which versions are affected by CVE-2021-40745?
It affects 1 product.
Products include Adobe Campaign.
How do I fix CVE-2021-40745?
No fix has been published for CVE-2021-40745 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-40745 being exploited?
There is no known exploitation of CVE-2021-40745 in the wild and no public exploit code.
Other vulnerabilities in Adobe Campaign
- CVE-2026-73369 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-75699 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-75703 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-75721 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-75723 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Sources
Also known as GHSA-22xh-v97v-2c2w.