Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Why this deserves its current priority

CVSS is 8.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Adobe/Adobe Experience Manager 6.5 (generic), Adobe/Adobe Experience Manager 6.5 LTS (generic), Adobe/Adobe Experience Manager as a Cloud Service (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Adobe/Adobe Experience Manager 6.5, Adobe/Adobe Experience Manager 6.5 LTS, Adobe/Adobe Experience Manager as a Cloud Service.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Jul 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 27, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 15, 2026

Sources and claim methodology

• Source referencehelpx.adobe.com

Related CVEs

• Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletionAlso CWE-22
• Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment FilenameAlso CWE-22
• RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversalAlso CWE-22
• arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversalAlso CWE-22
• MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversalAlso CWE-22
• Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgerySame generic ecosystem