A path traversal flaw in Adobe CAI Content Credential encoding tools allows an attacker to write files outside the allowed directory when a victim extracts a maliciously crafted file. This could be used to overwrite configuration files, replace legitimate assets, or introduce malicious code, potentially leading to further compromise of the host. The vulnerability is a typical Examples of CWE-22 wrongdoing and is limited to write operations, rather than full remote code execution.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. No specific version ranges are listed, so any deployment of these components should be reviewed for the risk. The absence of version data makes it unclear whether older releases still contain the flaw.

The CVSS score of 5.5 indicates moderate severity and the EPSS score of less than 1% shows that exploitation is considered unlikely at present. The vulnerability is not included in the CISA KEV catalog. Exploitation requires user interaction: a victim must extract a maliciously crafted file, so the attack is likely local or requires social engineering. Even with the low probability of exploitation, the potential for destructive writes justifies caution.