## SummaryCVE-2026-48441 affects Lightroom Classic and is a CWE-22 path traversal issue (Improper Limitation of a Pathname to a Restricted Directory). It can enable arbitrary file system read of sensitive files/directories outside the intended access scope.
Exploitation is local and requires user interaction (a victim must open a malicious file).
## Technical Details
- Vulnerability class: Path Traversal (CWE-22).
- Root condition (per NVD): improper restriction of a pathname to a restricted directory, allowing traversal to paths outside the intended scope.
- Impacted capability: reading files from the local file system beyond what the application should access.
- Scope: NVD notes “Scope is changed.”
## Affected
- Adobe Lightroom Classic (exact affected versions not provided in the supplied material).
## Impact
- Confidentiality: high risk due to arbitrary file system read (C:H).
- Integrity and Availability: NVD indicates potential impact (I:H, A:H), though the supplied description specifically emphasizes file read.
- Attack prerequisites: local attacker model with PR:N but UI:R (user must open a malicious file).
## Mitigation
1. Patch immediately to the latest available Lightroom Classic version from Adobe (no fixed version details were provided in the supplied material).
2. Reduce exposure by avoiding opening untrusted or unsolicited files that could trigger the traversal.
3. Apply least-privilege controls on the user account running Lightroom Classic to limit accessible local files in case of traversal.
4. Monitor for suspicious file access patterns on endpoints where Lightroom Classic is used (no detection indicators were provided in the supplied material).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-22