Loading vulnerability…
Adobe Animate Path Traversal Arbitrary Code Execution
CVE-2026-48350 is a CWE-22 path traversal vulnerability in Adobe Animate 2023 through version 23.0.15 and Adobe Animate 2024 through version 24.0.13. Crafted Animate content can cause pathname handling to access files or directories outside intended restrictions. If a victim opens a malicious file, the flaw can result in arbitrary code execution in the context of the current user. The vulnerability has changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows code execution with the privileges of the user running Adobe Animate and may permit access to sensitive files or directories outside the intended restricted location. Consequences include modification or deletion of accessible data and execution of attacker-controlled actions within that user's security context.
If you can’t patch tonight, do this now.
Until updates are deployed, do not open untrusted or unsolicited Animate files. Enforce least privilege by running Animate under non-administrative accounts, restrict delivery and execution of untrusted file types, and use endpoint exploit prevention, application allowlisting, and EDR controls to detect or prevent malicious execution.
Patch, then assume compromise.
Update Adobe Animate 2023 to version 23.0.16 or later, or Adobe Animate 2024 to version 24.0.14 or later. Apply updates through the Creative Cloud desktop application or deploy them through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.