CVE-2026-106634
7.7HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-22
Impact
Authenticated low-privileged attackers can write arbitrary files across the file system without any user interaction. This can lead to unauthorized file modification or secondary privilege escalation.
Root cause
Improper path validation permits path traversal sequences, allowing restricted directory boundaries to be bypassed during file writes.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Fix & remediation
Check the vendor advisory (apsb26-152) for the target fixed release and patch immediately; as an interim measure, restrict author/admin interface access to trusted networks and audit low-privileged accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.