CVE-2026-103820: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Adobe Content Credentials Rust SDK

The Adobe Content Credentials Rust SDK contains a path traversal vulnerability (CWE-22) that improperly limits pathnames to restricted directories. This flaw enables an attacker to write files to arbitrary locations on the file system outside the intended directory constraints. Successful exploitation requires user interaction, specifically the extraction of a maliciously crafted file by the victim. The vulnerability affects version 0 of the SDK and has a CVSS 3.1 base score of 5.5, indicating medium severity. There is no information on available patches or fixes.

An attacker who successfully exploits this vulnerability can write files to unauthorized locations on the file system, potentially leading to integrity violations. The vulnerability does not impact confidentiality or availability directly. Exploitation requires user interaction, limiting the attack vector to scenarios where a victim extracts a crafted file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when extracting files from untrusted sources to prevent exploitation.