Read the docs
TI-2020-20052 Aliases CVE-2020-9709GHSA-rwq8-6hff-hc5f

Security bypass in Adobe Photoshop can lead to privilege escalation

Priority LOW 23Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

Adobe Photoshop versions Photoshop CC 2019 and Photoshop 2020 are affected by a security bypass flaw. Successful exploitation could lead to privilege escalation.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.

Why it matters now

EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe PhotoshopPhotoshop CC 2019, and Photoshop 2020 versions—No fix listedCNA
  • Adobe Photoshop VendorAdobe Affected Photoshop CC 2019, and Photoshop 2020 versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Adobe Photoshop.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2020-9709
  2. 2026-11-06 Alias added: GHSA-rwq8-6hff-hc5f

References

Other 1

  • TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences