CVE-2026-48350 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in Adobe Animate 2023. This flaw enables an attacker to access files or directories outside the intended restricted area, potentially resulting in arbitrary code execution within the context of the current user. Exploitation requires that a victim opens a crafted malicious file, changing the security scope. The CVSS 3.1 base score is 8.6, reflecting high severity with local attack vector, low complexity, no privileges required, user interaction needed, and impacts to confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, unauthorized access to sensitive files or directories outside intended restrictions, and full compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or suspicious files in Adobe Animate 2023 to prevent exploitation.