CVE-2026-106634 — Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Description (CNA)

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.

Affected (CNA)

Vendor / product	Versions
Adobe / Adobe Experience Manager 6.5 LTS	affected 0 through 6.5 LTS SP3; unaffected 6.5 LTS SP1 - Hotfix for GRANITE-75052, 6.5 LTS SP2 - Hotfix for GRANITE-75052, 6.5 LTS SP3 - Hotfix for GRANITE-75052
Adobe / Adobe Experience Manager 6.5	affected 0 through 6.5.25; unaffected 6.5.23 - Hotfix for GRANITE-75052, 6.5.24 - Hotfix for GRANITE-75052, 6.5.25 - Hotfix for GRANITE-75052

CWE

CWE-22

References

https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.