← Back

CVE-2026-95634

nvd nist
Published: Oct 13, 2026Modified: Oct 15, 2026

JSON object

Loading...
8.6
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 4.0
Source: psirt@adobe.com (Secondary)

Description

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Affected (3)

Adobe
3 products
C2pa
C2pa Web
C2patool
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
C2pa
version < 0.91.1
C2pa Web
version < 0.15.3
C2patool
version < 0.28.1

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: psirt@adobe.com
Vendor Advisory

Timeline

No history available yet.