CVE-2026-48310 describes an improper limitation of a pathname to a restricted directory in Adobe Experience Manager as a Cloud Service. This path traversal vulnerability enables an attacker to access sensitive files and directories outside the intended access scope, potentially leading to disclosure of confidential information. The vulnerability can be exploited remotely without any user interaction and changes the security scope. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high impact on confidentiality with no impact on integrity or availability. No patch or remediation level is currently documented, and the product is not indicated as a cloud service in this data, so vendor-managed remediation cannot be assumed.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the affected system outside of the intended directory restrictions, leading to high confidentiality impact. There is no impact on integrity or availability. The vulnerability affects the security scope, potentially exposing sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Monitor Adobe's security advisories for updates and apply any patches or mitigations once available.