Description

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Severity (CVSS)

Base score7.4
SeverityHigh
VersionCVSS 3.1
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Provided byCNA

Weaknesses

  • CWE-426 — Untrusted Search Path (CWE-426)

Affected products

VendorProductVersions
AdobeContent Credentials Rust SDK0 to <=c2pa-v0.84.0; c2pa-v0.85.2
AdobeContent Credentials Command-Line Tool0 to <=c2patool-v0.16.5; c2patool-v0.26.65
AdobeContent Credentials JS SDK0 to <=@contentauth/c2pa-web@0.7.0; @contentauth/c2pa-web@0.9.0

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 15 Jul 2026 07:06 UTC.