CVE-2026-48350 describes an improper limitation of a pathname to a restricted directory in Adobe Animate 2023. This path traversal vulnerability enables an attacker to access files or directories outside the intended scope, potentially leading to arbitrary code execution within the context of the current user. Exploitation necessitates user interaction, specifically opening a crafted malicious file. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with low attack complexity, no privileges required, but user interaction needed, and a changed scope affecting confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, allowing unauthorized access to sensitive files or directories outside intended restrictions. This compromises confidentiality, integrity, and availability of the affected system. The attack requires user interaction, limiting remote exploitation without user involvement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering this vulnerability.