CVE-2026-34657 is a path traversal vulnerability in Adobe CAI Content Credentials ([email protected], c2pa-v0.80.1 and earlier) that improperly limits pathname access to restricted directories. This flaw enables an attacker who can trick a user into extracting a malicious file to write arbitrary files outside the intended directory restrictions. The vulnerability requires user interaction and does not affect confidentiality or availability but impacts integrity by allowing unauthorized file writes.

An attacker can write arbitrary files to locations outside the intended restricted directories, potentially leading to unauthorized modification of files on the victim system. This compromises data integrity but does not directly impact confidentiality or availability. Successful exploitation requires user interaction via extraction of a crafted file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should exercise caution when extracting files from untrusted sources to avoid triggering this vulnerability.