CAI Content Credentials | Untrusted Search Path (CWE-426)
Priority LOW 34CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.
Summary
CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed Content Credentials Rust SDK (Adobe): c2pa-v0.85.2Content Credentials Command-Line Tool (Adobe): c2patool-v0.26.65+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Content Credentials Rust SDK | up to c2pa-v0.84.0 | c2pa-v0.85.2 | Patch available | CNA |
| Adobe | Content Credentials Command-Line Tool | up to c2patool-v0.16.5 | c2patool-v0.26.65 | Patch available | CNA |
| Adobe | Content Credentials JS SDK | up to @contentauth/[email protected] | @contentauth/[email protected] | Patch available | CNA |
- Content Credentials Rust SDK VendorAdobe Affected up to c2pa-v0.84.0 Fixed in c2pa-v0.85.2 Patch available CNA
- Content Credentials Command-Line Tool VendorAdobe Affected up to c2patool-v0.16.5 Fixed in c2patool-v0.26.65 Patch available CNA
- Content Credentials JS SDK VendorAdobe Affected up to @contentauth/[email protected] Fixed in @contentauth/[email protected] Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:* | up to 0.84.0 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:* | up to 0.7.0 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:* | up to 0.17.0 | Vulnerable | Adobe |
| cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:google:android:-:*:*:*:*:*:*:* | not specified by NVD | Running on | |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:* Versions up to 0.84.0 Vulnerable ·Adobe
- cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:* Versions up to 0.7.0 Vulnerable ·Adobe
- cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:* Versions up to 0.17.0 Vulnerable ·Adobe
- cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Content Credentials Rust SDK (Adobe) Fixed in c2pa-v0.85.2
- Fix · CNA Content Credentials Command-Line Tool (Adobe) Fixed in c2patool-v0.26.65
- Fix · CNA Content Credentials JS SDK (Adobe) Fixed in @contentauth/[email protected]
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Adobe Content Credentials Command-Line Tool, Content Credentials JS SDK, Content Credentials Rust SDK — helpx.adobe.com/security/products/content-authenticity-sdk/…
12 records Highest priority Priority MEDIUM 3 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-35758 CAI Content Credentials | Improper Input Validation (CWE-20)Priority MEDIUM 41
- TI-2026-35757 CAI Content Credentials | Improper Input Validation (CWE-20)Priority MEDIUM 41
- TI-2026-35701 CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)Priority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48287
- 2026-10-03 Alias added: GHSA-g23w-pc29-375j
References
More Adobe C2pa vulnerabilities
- TI-2026-73741 Server-side request forgery in Adobe CAI Content Credentials CVSS 3.1HIGH 8.6
- TI-2026-52923 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) CVSS 3.1HIGH 7.5
- TI-2026-50063 CAI Content Credentials | Improper Input Validation (CWE-20) CVSS 3.1HIGH 7.5
- TI-2026-50062 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) CVSS 3.1HIGH 7.5
- TI-2026-50009 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) CVSS 3.1HIGH 7.5
- TI-2026-35833 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) CVSS 3.1HIGH 7.5
Sources
- CVE-2026-48287 · CVE Program
- CVE-2026-48287 · NVD
- FIRST EPSS
- GHSA-g23w-pc29-375j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences