CVE-2026-103820: CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that extract maliciously crafted files with CAI Content Credentials are exposed. Exploitation requires a victim to perform the extraction.
What does an attacker need to exploit it?
An attacker needs to provide a maliciously crafted file and convince a victim to extract it. The attacker does not need privileges, but exploitation requires local access and user interaction according to the supplied vector.
What is the potential impact after successful exploitation?
Successful exploitation could allow arbitrary file system writes to files or directories outside the intended extraction restrictions. The supplied impact information identifies integrity impact and does not indicate confidentiality or availability impact.