CVE-2026-79904 in Photoshop
Summary
by MITRE • 09/08/2026
Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The identified vulnerability within Photoshop Mobile represents a critical failure in input validation and path normalization logic, specifically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This class of flaw occurs when an application accepts user-supplied input that is used as part of a file system operation without adequately sanitizing or validating the provided pathname. In this specific instance, the vulnerability allows for path traversal attacks where an attacker can manipulate directory navigation sequences, such as using dot-dot-slash (../) patterns, to break out of the intended sandboxed environment. The core technical flaw lies in the application's inability to correctly resolve relative paths against a restricted base directory, thereby permitting access to files and directories that reside outside the designated secure scope. This lack of strict boundary enforcement undermines the fundamental security principle of least privilege, allowing processes or users with limited permissions to escalate their reach into sensitive areas of the file system.
From an operational perspective, this vulnerability facilitates unauthorized data exfiltration and potential configuration tampering by a low-privileged attacker. By leveraging this path traversal weakness, an adversary can read arbitrary files from the device's storage, potentially exposing user credentials, cached session tokens, or proprietary project data stored locally on the mobile device. Furthermore, if write permissions are inadvertently granted to certain traversed directories, the impact could extend to modifying application settings or injecting malicious content into trusted file locations. The severity of this issue is compounded by its dependency on social engineering tactics; exploitation requires user interaction as a victim must explicitly open a crafted malicious file. This requirement aligns with ATT&CK technique T1204: User Execution, indicating that while the technical flaw exists in the software architecture, successful compromise relies heavily on deceiving the end-user into initiating the attack vector through deceptive file handling practices.
The exploitation of this vulnerability is contingent upon conditions beyond the attacker's direct control regarding the specific environment and user behavior, yet it remains a significant risk due to the high likelihood of users opening files from untrusted sources in mobile environments where sandboxing expectations may be lower than on desktop systems. The presence of such a flaw suggests that the application does not sufficiently validate file paths before processing them for read or write operations. This oversight creates an attack surface where malicious actors can craft specially designed image, document, or configuration files containing embedded path traversal sequences. When Photoshop Mobile processes these inputs without proper sanitization, it interprets the relative navigation commands literally rather than resolving them within the allowed directory tree, effectively bypassing security features intended to isolate application data from the broader operating system file structure.
To mitigate this vulnerability and prevent similar occurrences in future updates, developers must implement rigorous input validation strategies that strictly enforce allow-lists for permitted characters and path structures. All user-supplied paths should be normalized using secure library functions before being passed to any file system APIs, ensuring that relative components are resolved correctly against the base directory without allowing escape sequences. Additionally, implementing strict sandboxing mechanisms at both the application level and the operating system level can provide defense-in-depth layers that restrict access even if path validation fails. Security teams should also enforce principle of least privilege by running the mobile application with minimal necessary permissions, thereby limiting the potential impact of any successful exploitation attempt. Regular security code reviews focusing on file I/O operations are essential to identify and rectify such logic flaws before they can be leveraged in real-world attacks targeting mobile productivity applications.