Dreamweaver Desktop versions 21.7 and earlier contain an Improper Input Validation flaw that permits reading files outside the intended scope. An attacker who can supply a maliciously crafted file to the application can trigger the flaw, leading to disclosure of sensitive files and directories on the system. Because the vulnerability changes the scope, the read privilege may extend beyond the standard sandboxed environment of the application, potentially exposing system‑wide data.

Adobe Dreamweaver Desktop, all installations running version 21.7 or earlier. The vulnerability applies to any product build that has not received the Adobe patch for this issue.

The CVSS score of 6.3 indicates a moderate severity, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. The attack requires user interaction; a victim must open a malicious file within Dreamweaver. The scope change increases the potential impact beyond the application itself, raising the risk if such a file is processed.