CVE-2026-123267 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

What is CVE-2026-123267?

CVE-2026-123267 is a medium-severity vulnerability in Adobe C2PA Tool, published on 10 Nov 2026.

Official description

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Weakness: CWE-22

Which versions are affected by CVE-2026-123267?

How do I fix CVE-2026-123267?

No fix has been published for CVE-2026-123267 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123267 being exploited?

There is no known exploitation of CVE-2026-123267 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hq8w-v7jv-v58m.