---
id: "CVE-2026-113532"
page: "https://infrastack.ai/live/CVE-2026-113532"
kind: "vulnerability"
aliases: ["CVE-2026-113532"]
title: "Adobe After Effects: path traversal via a malicious file can lead to code execution (APSB26-100)"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "After Effects", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5, <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe", "after-effects", "creative-cloud", "macos", "other", "user-interaction", "windows"]
not_affected_if: ["no-after-effects-install", "no-untrusted-project-files"]
published_at: "2026-11-10T21:18:45+00:00"
first_seen_at: "2026-11-10T21:46:10+00:00"
updated_at: "2026-11-10T21:59:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113532", "first_seen_at": "2026-11-10T21:46:10+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html", "first_seen_at": "2026-11-10T21:59:13+00:00", "cites": ["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}]
exploit_sources: []
---

# Adobe After Effects: path traversal via a malicious file can lead to code execution (APSB26-100)

Link for people: https://infrastack.ai/live/CVE-2026-113532 (this .md is for agents)

Adobe bulletin APSB26-100 (Nov 10, 2026) lists CVE-2026-113532, a path traversal (CWE-22) in After Effects rated High, CVSS 8.6. Adobe gives the impact as arbitrary code execution; the NVD-derived text about reading files is not Adobe's wording. The vector is local and needs the user to open a malicious file. Adobe is not aware of exploits in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5, <= 25.6.6 fixed 26.5.3, 27.0

## How to check

In After Effects open Help > About After Effects (or the Creative Cloud app) and read the version. Exposed if it is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier on the 25.x line (Windows and macOS).

## Fix

Update to After Effects 27.0 or 26.5.3 via the Creative Cloud desktop app or the Download Center. Adobe lists no fixed build for the 25.x line; move to 26.5.3 or later.

## Timeline

- 2026-11-10T21:46:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113532
- 2026-11-10T21:59:13+00:00 analyst https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html — Read Adobe APSB26-100: affected/fixed versions and impact (code execution per Adobe) confirmed; no exploitation, no PoC seen. Social search skipped, new same-day patch.

## Documents

- [advisory] Adobe APSB26-100: Security update available for Adobe After Effects https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html

## From the sources

After Effects is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_