{"id":"CVE-2026-113532","kind":"vulnerability","aliases":["CVE-2026-113532"],"related":[],"title":"Adobe After Effects: path traversal via a malicious file can lead to code execution (APSB26-100)","description":"After Effects is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe bulletin APSB26-100 (Nov 10, 2026) lists CVE-2026-113532, a path traversal (CWE-22) in After Effects rated High, CVSS 8.6. Adobe gives the impact as arbitrary code execution; the NVD-derived text about reading files is not Adobe's wording. The vector is local and needs the user to open a malicious file. Adobe is not aware of exploits in the wild.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe","after-effects","creative-cloud","macos","other","user-interaction","windows"],"not_affected_if":["no-after-effects-install","no-untrusted-project-files"],"how_to_check":"In After Effects open Help > About After Effects (or the Creative Cloud app) and read the version. Exposed if it is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier on the 25.x line (Windows and macOS).","fix":"Update to After Effects 27.0 or 26.5.3 via the Creative Cloud desktop app or the Download Center. Adobe lists no fixed build for the 25.x line; move to 26.5.3 or later.","status":"open","published_at":"2026-11-10T21:18:45+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:47:51+00:00","updated_at":"2026-11-10T21:59:13+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T21:47:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: path traversal lets a malicious file read local files","impact":"medium","summary":"Adobe After Effects has a path traversal flaw that can let an attacker read files and directories outside the intended scope. Exploitation needs a victim to open a malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["after-effects","adobe","creative-cloud"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive files outside the intended directory on the machine.","analyst_note":"Confirm affected After Effects versions and fixed build from the Adobe security bulletin; NVD entry alone gives no version ranges.","how_to_check":"- Check the installed After Effects version in the Creative Cloud app or the application's About screen.\n- unknown","plain_action":"","product_name":"After Effects","needs_analyst":true,"not_affected_if":["no-after-effects-install"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":4583,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected After Effects versions and fixed build from the Adobe security bulletin; NVD entry alone gives no version ranges.","search":"'-100':16A,41B '-113532':19A,22A,48B '-2026':18A,21A,47B '-22':53B '10':43B '2026':44B '8.6':60B 'access':137C,145C 'adob':1A,25B,38B,61B,79B,95B 'affect':107C 'after':23A 'after-effect':26B 'apsb26':15A,40B 'arbitrari':66B,126C 'attack':131C 'awar':98B 'bulletin':39B 'chang':165C 'cloud':31B 'code':13A,67B 'could':123C,132C 'creativ':30B 'creative-cloud':29B 'cve':17A,20A,46B 'cvss':59B 'cwe':52B 'deriv':72B 'directori':118C,141C 'effect':3A,28B,56B,105C 'effects':24A 'execut':14A,68B 'exploit':100B,133C,147C 'file':9A,76B,94B,127C,139C,162C 'give':62B 'high':58B 'impact':64B 'improp':110C 'intend':144C 'interact':36B,153C 'issu':150C 'lead':11A,124C 'limit':111C 'list':45B 'local':85B 'maco':32B 'malici':8A,93B,161C 'must':158C 'need':87B 'nov':42B 'nvd':71B 'nvd-deriv':70B 'open':91B,159C 'outsid':142C 'path':4A,50B,119C 'pathnam':114C 'rate':57B 'read':75B,129C 'requir':151C 'restrict':117C 'scope':146C,163C 'sensit':138C 'system':128C 'text':73B 'travers':5A,51B,120C 'user':35B,89B,152C 'user-interact':34B 'vector':83B 'via':6A 'victim':157C 'vulner':121C,135C 'wild':103B 'window':37B 'word':81B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects 26.5 or earlier, or 25.6.6 or earlier, on Windows or macOS is affected. Exploitation needs the user to open a malicious file, so studios and freelancers who receive project files or assets from outside are the ones to prioritise. Machines without After Effects, or users who only open trusted files, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:59:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2897},"products":{"at":"2026-11-10T21:59:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2897},"how_to_check":{"at":"2026-11-10T21:59:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2897},"who_affected":{"at":"2026-11-10T21:59:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2897}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobe","aftereffects","creativecloud","high","macos","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-100':16A '-113532':19A,22A '-2026':18A,21A 'adob':1A 'after':23A 'apsb26':15A 'code':13A 'cve':17A,20A 'effect':3A 'effects':24A 'execut':14A 'file':9A 'lead':11A 'malici':8A 'path':4A 'travers':5A 'via':6A","search_b":"'-100':41B '-113532':48B '-2026':47B '-22':53B '10':43B '2026':44B '8.6':60B 'adob':25B,38B,61B,79B,95B 'after-effect':26B 'apsb26':40B 'arbitrari':66B 'awar':98B 'bulletin':39B 'cloud':31B 'code':67B 'creativ':30B 'creative-cloud':29B 'cve':46B 'cvss':59B 'cwe':52B 'deriv':72B 'effect':28B,56B 'execut':68B 'exploit':100B 'file':76B,94B 'give':62B 'high':58B 'impact':64B 'interact':36B 'list':45B 'local':85B 'maco':32B 'malici':93B 'need':87B 'nov':42B 'nvd':71B 'nvd-deriv':70B 'open':91B 'path':50B 'rate':57B 'read':75B 'text':73B 'travers':51B 'user':35B,89B 'user-interact':34B 'vector':83B 'wild':103B 'window':37B 'word':81B","search_c":"'access':137C,145C 'affect':107C 'arbitrari':126C 'attack':131C 'chang':165C 'could':123C,132C 'directori':118C,141C 'effect':105C 'exploit':133C,147C 'file':127C,139C,162C 'improp':110C 'intend':144C 'interact':153C 'issu':150C 'lead':124C 'limit':111C 'malici':161C 'must':158C 'open':159C 'outsid':142C 'path':119C 'pathnam':114C 'read':129C 'requir':151C 'restrict':117C 'scope':146C,163C 'sensit':138C 'system':128C 'travers':120C 'user':152C 'victim':157C 'vulner':121C,135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113532","severity":null,"published_at":"2026-11-10T21:18:45+00:00","modified_at":"2026-11-10T21:18:45+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113532:2897","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T21:59:13+00:00","modified_at":"2026-11-10T21:59:13+00:00","first_seen_at":"2026-11-10T21:59:13+00:00","fetched_at":"2026-11-10T21:59:13+00:00","note":"Read Adobe APSB26-100: affected/fixed versions and impact (code execution per Adobe) confirmed; no exploitation, no PoC seen. Social search skipped, new same-day patch.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}