PatchSiren cyber security CVE debrief

CVE-2026-34657 Adobe CVE debrief

CVE-2026-34657 is a Path Traversal vulnerability affecting CAI Content Credentials versions [email protected], c2pa-v0.80.1, and earlier. This vulnerability could result in an arbitrary file system write, allowing an attacker to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction, as a victim must extract a maliciously crafted file.

Vendor: Adobe
Product: CAI Content Credentials
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-09
Original CVE updated: 2026-06-10
Advisory published: 2026-06-09
Advisory updated: 2026-06-10

Who should care

Users of CAI Content Credentials versions [email protected], c2pa-v0.80.1, and earlier should be aware of this vulnerability and take necessary precautions.

Technical summary

The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The weakness is classified as CWE-22.

Defensive priority

MEDIUM

Recommended defensive actions

Update to a version of CAI Content Credentials that is not affected by this vulnerability.
Be cautious when extracting files from untrusted sources.

Evidence notes

The CVE record was published on 2026-06-09T22:16:22.787Z and modified on 2026-06-10T18:35:49.083Z. The vendor is listed as Unknown Vendor, but there is evidence suggesting the vendor may be Adobe.

Official resources

CVE-2026-34657 was published on 2026-06-09T22:16:22.787Z.