Dreamweaver Desktop versions 21.7 and earlier contain an Incorrect Authorization flaw that can allow an attacker to read arbitrary files from the system. Opening a malicious file triggers the bug, exposing sensitive files and directories outside the intended access scope. The issue stems from an inadequate authorization check for file access, classified as CWE-863, and results in a confidentiality breach without granting code execution or privilege escalation.

Adobe Dreamweaver Desktop versions 21.7 and earlier are affected. The vulnerability applies to any installation of these releases, but the specific operating systems are not listed in the data.

The CVSS score of 6.3 rates the vulnerability as moderate. No EPSS metric is available, so the exploitation probability cannot be quantified, and the issue is not listed in the CISA KEV catalog. Exploitation requires user interaction—a victim must open a malicious file—and the scope is changed, meaning the flaw can affect system resources beyond the initial compromised area. Attackers can craft files that, when processed by Dreamweaver, bypass the authorization check and return file contents to the attacker. Given the need for user action and the moderate impact, the risk is moderate but warrants remediation.