{"id":"CVE-2026-113576","kind":"vulnerability","aliases":["CVE-2026-113576"],"related":[],"title":"Adobe Digital Editions: path traversal lets a malicious file write outside its folder","description":"Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe Digital Editions, an ebook reader, mishandles file paths so a crafted file can bypass security checks and write to unauthorized locations. An attacker gets write access to files on the victim's machine once the victim opens the malicious file.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-digital-editions","desktop","other"],"not_affected_if":["no-untrusted-files","not-installed"],"how_to_check":"- Check the installed Adobe Digital Editions version in the application's About dialog; the sources do not name the affected version range.","fix":null,"status":"open","published_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:31:33+00:00","updated_at":"2026-10-29T16:31:33+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T16:31:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Digital Editions: path traversal lets a malicious file write outside its folder","impact":"medium","summary":"Adobe Digital Editions, an ebook reader, mishandles file paths so a crafted file can bypass security checks and write to unauthorized locations. An attacker gets write access to files on the victim's machine once the victim opens the malicious file.","audience":"everyone","category":"other","nicknames":[],"who_cares":["adobe-digital-editions","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker writes files to unauthorized locations on the victim's machine","analyst_note":"Check the Adobe security bulletin for the affected version range and fixed version; the NVD entry alone does not state either.","how_to_check":"- Check the installed Adobe Digital Editions version in the application's About dialog; the sources do not name the affected version range.\n- unknown","plain_action":"If you use Adobe Digital Editions to read ebooks, update it to the latest version from Adobe and do not open ebook files from unknown sources until you have.","needs_analyst":true,"not_affected_if":["not-installed","no-untrusted-files"],"who_is_affected":"Anyone running Adobe Digital Editions on a desktop who opens files from an untrusted source. The sources do not describe server-side or enterprise-only exposure. unknown for the exact affected version range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4161,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113576':16A,19A '-2026':15A,18A 'access':51B,107C 'adob':1A,21B,25B,66C 'adobe-digital-edit':20B 'affect':70C 'attack':48B,94C 'bypass':39B,92C,100C 'chang':126C 'check':41B 'could':86C,95C 'craft':36B 'cve':14A,17A 'desktop':24B 'digit':2A,22B,26B,67C 'directori':81C 'ebook':29B 'edit':3A,23B,27B,68C 'exploit':108C 'featur':91C 'file':9A,32B,37B,53B,65B,123C 'folder':13A 'gain':104C 'get':49B 'improp':73C 'interact':114C 'issu':111C 'let':6A 'leverag':96C 'limit':74C 'locat':46B 'machin':58B 'malici':8A,64B,122C 'measur':102C 'mishandl':31B 'must':119C 'open':62B,120C 'outsid':11A 'path':4A,33B,82C 'pathnam':77C 'reader':30B 'requir':112C 'restrict':80C 'result':87C 'scope':124C 'secur':40B,90C,101C 'travers':5A,83C 'unauthor':45B,105C 'user':113C 'victim':56B,61B,118C 'vulner':84C,98C 'write':10A,43B,50B,106C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Digital Editions on a desktop who opens files from an untrusted source. The sources do not describe server-side or enterprise-only exposure. unknown for the exact affected version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use Adobe Digital Editions to read ebooks, update it to the latest version from Adobe and do not open ebook files from unknown sources until you have.","first_public_at":"2026-10-29T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113576","severity":null,"published_at":"2026-10-29T16:17:58+00:00","modified_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}