CVE-2026-48310 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in Adobe Experience Manager as a Cloud Service. This flaw allows an unauthenticated attacker to read arbitrary files on the file system outside the intended access scope, potentially exposing sensitive information. The vulnerability does not require user interaction and affects the confidentiality of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact. No vendor advisory or patch information is currently available, and the product is not indicated as a cloud service for which vendor-managed remediation applies.

An attacker can exploit this vulnerability remotely without authentication or user interaction to read sensitive files outside the intended directory restrictions. This compromises confidentiality but does not affect integrity or availability. The scope change indicates that the vulnerability impacts resources beyond the original security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Monitor Adobe's security advisories for updates and apply patches promptly once available.