Adobe Experience Manager is affected by a path traversal flaw that allows an attacker with low privileges to write files to arbitrary locations on the file system. This leads to a change of scope and can be used to place malicious files, potentially enabling further compromise such as injecting executable code. The vulnerability does not require user interaction and can be exploited from a remote context where the attacker can interact with the CMS. The description explicitly notes that exploitation can happen without any additional user action, highlighting the seriousness of the issue.

Adobe Experience Manager version 6.5 and 6.5 LTS are impacted. These are the explicitly listed products in the CVE advisory. No other versions or editions were mentioned in the data, so the risk is confined to the identified releases.

The CVSS base score of 7.7 indicates high severity, and with a scope change the potential for damage is amplified. EPSS is not available, so the current probability of exploitation in the wild cannot be quantified, but the lack of user interaction and open file-write capability make it a strong candidate for exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of public exposure does not diminish the need for rapid remediation. The most likely attack vector is path traversal via the CMS file upload or ingestion mechanisms, as indicated by the CWE-22 classification.