Executive brief
Adobe Photoshop Mobile contains a path traversal vulnerability that allows a low-privileged attacker to access files and directories outside the intended restrictions. An attacker could craft a malicious file that, when opened by a user, bypasses security controls and exposes unauthorized data. This could lead to unauthorized access to sensitive files stored on the device.
Technical details
The vulnerability is an improper limitation of pathname input (CWE-22: Path Traversal), where the application fails to properly validate or sanitize file paths before processing them. The attack vector requires user interaction—a victim must open a malicious file crafted by the attacker. A low-privileged attacker can leverage path traversal sequences (e.g., "../" or absolute paths) to escape the intended directory sandbox and access restricted files or directories. Exploitation depends on conditions beyond the attacker's control, suggesting the vulnerability may require specific file system configurations or application states. A patch is expected in Adobe Security Bulletin APSB26-136, though the specific versions and fix details were not accessible at time of analysis.
Affected products
- Adobe Photoshop Mobile
Timeline
- 2026-09-08: disclosed