CVE Catalog

CVE-2026-34657

MediumCVSS 5.5
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.18%

7th percentile - higher than 7% of all known CVEs

Summary

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by a Path Traversal vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation requires user interaction in that a victim must extract a maliciously crafted file.

Risk Assessment

The risk involves the possibility of writing malicious files to arbitrary system locations, which could lead to system compromise or data corruption.

Recommendation

It is recommended to update CAI Content Credentials to the latest available version, which includes a fix for this vulnerability.

Other vulnerabilities in CAI Content Credentials

See all
Original NVD description (English source)

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS