CVE-2026-106634

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:experience_manager:::::lts:::*
	cpe:2.3:a:adobe:experience_manager:::::-:::*

History

30 Oct 2026, 13:34

Type	Values Removed	Values Added
First Time		Adobe Adobe experience Manager
CPE		cpe:2.3:a:adobe:experience_manager:::::lts:::* cpe:2.3:a:adobe:experience_manager:::::-:::*
References	~~() https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html -~~	() https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html - Broken Link

13 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 20:17

Updated : 2026-10-30 13:34

NVD link : CVE-2026-106634

Mitre link : CVE-2026-106634

CVE.ORG link : CVE-2026-106634

JSON object : View

Products Affected

adobe

experience_manager

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-106634", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106634", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-17T00:43:04.483519Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Experience Manager 6.5 LTS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5 LTS SP3"}, {"status": "unaffected", "version": "6.5 LTS SP1 - Hotfix for GRANITE-75052, 6.5 LTS SP2 - Hotfix for GRANITE-75052, 6.5 LTS SP3 - Hotfix for GRANITE-75052", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Adobe Experience Manager 6.5", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5.25"}, {"status": "unaffected", "version": "6.5.23 - Hotfix for GRANITE-75052, 6.5.24 - Hotfix for GRANITE-75052, 6.5.25 - Hotfix for GRANITE-75052", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-13T20:17:17.103", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html", "tags": ["Broken Link"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed."}], "lastModified": "2026-10-30T13:34:24.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B296698A-B2AD-4522-99E8-D675FE5936BB", "versionEndIncluding": "6.5"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "C8849F58-C7F7-4E39-A3F0-6305BAE9D523", "versionEndIncluding": "6.5.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}