CVE-2026-106634: Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Published Oct 13, 2026
·Updated
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
1 affected component
Adobe Adobe Experience Manager
Event History
Oct 13, 2026
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs low-privileged access to Adobe Experience Manager. Exploitation does not require user interaction.
2
What could successful exploitation allow?
Successful exploitation could allow the attacker to write files to unauthorized locations on the underlying file system. The vulnerability has integrity impact and changed scope.