CVE-2026-47909 is an improper input validation vulnerability (CWE-20) in Adobe Dreamweaver Desktop (versions 21.7 and earlier). This flaw allows an attacker to read arbitrary files on the victim's file system by tricking the user into opening a malicious file. The vulnerability affects confidentiality by enabling unauthorized file access and changes the security scope. No privilege is required, but user interaction is necessary. The CVSS 3.1 base score is 6.3, reflecting a medium severity impact with high confidentiality impact, no integrity or availability impact, and low attack complexity.

Successful exploitation can lead to unauthorized disclosure of sensitive files and directories outside the intended access scope, compromising confidentiality. There is no impact on integrity or availability. The attack requires user interaction and no privileges, but it changes the security scope, increasing risk to the affected system's data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability.