Adobe Connect is vulnerable to an Improper Limitation of a Pathname to a Restricted Directory error that could allow a remote attacker to read any file on the server's file system. The flaw enables an attacker to construct a request without needing any user interaction, and the scope change in the scoring indicates that the vulnerability can affect the entire system beyond a single component. If exploited, the attacker can gain confidential information from sensitive configuration files, logs, or other data stored outside the intended access scope, potentially facilitating further attacks.

The vulnerability affects Adobe Connect on all platforms and the Adobe Connect Android Mobile App. No specific version numbers are listed, so all current and past releases are considered at risk until a patch is applied.

The CVSS score of 8.6 marks this as a high‑severity risk, and the EPSS score is 1%, the lack of user interaction and the scope‑changing nature of the flaw suggest that exploitation is feasible through remote network access. The vulnerability is not listed in the CISA KEV catalog, which implies no publicly known exploit at the time of analysis, but the high score warrants immediate attention. The likely attack vector is a crafted HTTP request to the Connect server that bypasses directory restrictions, inferred from the description.