Adobe Experience Manager Path Traversal Vulnerability Allowing Arbitrary File System Read

A path traversal vulnerability has been identified in Adobe Experience Manager (AEM) that could lead to arbitrary file system read. This issue affects AEM Cloud Service (CS) Release 2026.5.0 and earlier, as well as AEM 6.5 LTS Service Pack 1 and earlier and AEM 6.5 Service Pack 24 and earlier. The vulnerability arises from improper limitations on pathname access, allowing attackers to read sensitive files and directories outside of the intended access scope. Exploitation of this vulnerability does not require user interaction.

Impact

Successful exploitation allows attackers to access sensitive files and directories outside the intended access scope, potentially leading to unauthorized disclosure of information.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service (CS) Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.