CVE-2026-106634: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106634 is a path traversal vulnerability in Adobe Experience Manager 6.5 LTS that permits an attacker with low privileges to write arbitrary files outside of intended directories. This improper limitation of pathname to restricted directories can be exploited remotely without user interaction. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS 3.1 base score is 7.7 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with low privileges can write arbitrary files to unauthorized locations on the file system, potentially leading to integrity compromise of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely without user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected Adobe Experience Manager instances and monitor for suspicious file writes. Follow Adobe's official advisories for updates.