CVE-2026-34657 is a path traversal vulnerability in Adobe CAI Content Credentials (versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier) that improperly limits pathname access to restricted directories. This flaw could allow an attacker to write arbitrary files to unauthorized locations on the file system when a victim extracts a maliciously crafted file. The attack vector requires local user interaction, and no privilege is required to exploit it. The vulnerability impacts integrity but not confidentiality or availability.

Successful exploitation can lead to arbitrary file writes outside of intended directories, potentially allowing modification or replacement of files. This impacts the integrity of the affected system. There is no direct impact on confidentiality or availability reported. Exploitation requires user interaction, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when extracting files from untrusted sources to avoid processing maliciously crafted files.