The Adobe Content Credentials Rust SDK suffers from an improper limitation of a pathname to a restricted directory (CWE-22), enabling path traversal attacks. This flaw allows attackers to access sensitive files and directories beyond the intended scope by manipulating file path inputs. Successful exploitation requires user interaction, specifically the victim engaging with maliciously crafted URLs or compromised web content. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.5, reflecting a local attack vector with low complexity and no privileges required but requiring user interaction. No official patch or remediation level has been disclosed by Adobe as of the publication date.

An attacker can read arbitrary files on the victim's system outside the intended directory scope, potentially exposing sensitive information. The attack requires the victim to interact with malicious content, limiting the attack vector to user-initiated actions. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted URLs or web pages that could trigger this vulnerability.