CVE-2026-103820

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1038217.8Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of tCVE-2026-1038225.5Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker couCVE-2026-1038235.5Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An CVE-2026-1038245.5Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attCVE-2026-1038255.5Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker couCVE-2026-1038265.5Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attCVE-2026-1038275.5Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An CVE-2026-1038285.5Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attCVE-2026-1038295.5Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attCVE-2026-1038307.8Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contextCVE-2026-1038317.5CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the useCVE-2026-1038327.8Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the
CVE-2026-103820: Medium severity, CVSS 5.5 | Vulnix