CVE-2026-79904

MediumCVSS 5.0/10Last modified Sep 9, 2026

Description

Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-799055.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-799067.8Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-799077.8Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. CVE-2026-799087.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-799097.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-79918.8Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute aCVE-2026-799105.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverCVE-2026-7991110.0A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig ofCVE-2026-799128.3A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-CVE-2026-799136.5Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard inCVE-2026-799169.1MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters intoCVE-2026-799176.5MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat
CVE-2026-79904: Medium severity, CVSS 5.0 | Vulnix