Adobe Framemaker released up to version 2022.8 contains an improper input validation flaw that allows an attacker to read arbitrary files on the system. The issue is triggered when a user opens a maliciously crafted file; the application fails to validate path names and processes them as legitimate, enabling the attacker to view any file accessible to the Framemaker process.

Adobe Framemaker versions 2022.8 and earlier are affected. The vulnerability does not appear in any newer releases listed in the advisory.

The CVSS score of 6.3 indicates medium severity. Exploitability data are limited; the exploit probability score is not provided by the vendor. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that it has not been widely exploited. The attack requires user interaction—opening a malicious file—meaning the risk is confined to environments where untrusted documents can be accessed or shared with users.