Description

Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-11T18:17:32.457Z",
  "pubdate": "2026-08-11T18:17:32.457Z",
  "executiveSummary": "Adobe Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory vulnerability, commonly classified as Path Traversal, which introduces severe security risks to the underlying host system.\nThe primary impact of this security flaw is arbitrary file system read capability, allowing an unauthorized entity to access sensitive files and directories residing strictly outside the intended operational access scope.\nThe affected product in this security context is Lightroom Classic, and successful exploitation carries significant risk implications regarding confidentiality by exposing sensitive system or user data.\nTo achieve successful exploitation, the adversary requires specific user interaction, meaning a potential victim must explicitly open a maliciously crafted file supplied by the attacker.\nThe overall security scope for this vulnerability is explicitly changed, indicating that the impact extends beyond the boundaries of the vulnerable application into the broader host file system architecture.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization regarding file path parameters within Lightroom Classic, specifically failing to properly restrict pathnames to authorized directories.\nThe vulnerable component of the application improperly processes directory traversal sequences, such as dot-dot-slash patterns, allowing path resolution routines to escape the intended restricted directory scope.\nExploitation of this path traversal vector is driven by a malicious file designed to manipulate the application's file parsing or handling routines upon being opened by a user.\nThe step-by-step attack flow begins when an attacker constructs a malicious file containing crafted path traversal sequences designed to target specific sensitive files on the host file system.\nThe adversary delivers this malicious file to the target victim via social engineering, email, or external media, relying entirely on victim interaction to trigger the parsing logic.\nOnce the victim opens the malicious file within Lightroom Classic, the application processes the embedded path traversal payload without adequate validation of the target path boundaries.\nBecause the application runs within the context of the user, it attempts to resolve the manipulated path relative to the file system, thereby traversing outside the restricted application directory.\nThe payload behavior successfully forces the application to read the targeted arbitrary files from the host file system and potentially exposes the retrieved contents.\nRegarding authentication and privilege requirements, the attack does not inherently require prior authentication or elevated system privileges within the application, but relies heavily on the local user privileges associated with the running instance of Lightroom Classic.\nThe post-exploitation impact centers on the arbitrary file system read capability, which enables unauthorized disclosure of sensitive local files, configuration data, or personal documents accessible to the user context."
}