CVE-2026-47907 Overview
CVE-2026-47907 is an Improper Access Control vulnerability [CWE-284] affecting Adobe Dreamweaver Desktop versions 21.7 and earlier. The flaw permits arbitrary file system read operations outside the intended access scope. An attacker can use the issue to retrieve sensitive files and directories from a victim's host. Exploitation requires user interaction: the victim must open a malicious file in Dreamweaver. The CVSS scope is changed, indicating impact reaches resources beyond the vulnerable component.
Critical Impact
Successful exploitation allows attackers to read arbitrary files outside Dreamweaver's intended access boundary, exposing sensitive credentials, configuration data, and project artifacts on the affected workstation.
Affected Products
- Adobe Dreamweaver Desktop version 21.7
- Adobe Dreamweaver Desktop versions earlier than 21.7
- Windows and macOS Dreamweaver installations within the affected version range
Discovery Timeline
- 2026-06-09 - CVE-2026-47907 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47907
Vulnerability Analysis
The vulnerability resides in Dreamweaver's file handling logic when processing externally supplied project or document files. Dreamweaver fails to enforce access boundaries on referenced file paths during parsing. An attacker crafts a malicious file that references resources outside the intended working directory. When the victim opens the file, Dreamweaver reads those external resources and exposes their contents through application behavior or rendered output.
The attack vector is local and requires user interaction, but the changed scope indicates the impact extends beyond Dreamweaver's own security boundary. Confidentiality and integrity impacts are both rated high, while availability is not affected. The EPSS data indicates a low current probability of exploitation in the wild.
Root Cause
The root cause is improper access control [CWE-284] in Dreamweaver's file reference resolution. The application trusts path references contained inside opened documents without validating them against an allowlist or sandbox boundary. This allows file paths to traverse to locations the user did not intend to expose to the application context.
Attack Vector
An attacker delivers a malicious Dreamweaver project file, template, or supported document through phishing, file sharing services, or a compromised collaboration channel. The victim opens the file in Dreamweaver. The application then resolves embedded references that point to arbitrary file system locations. Sensitive files including SSH keys, browser data, configuration files, and source code become readable to the attacker through application-mediated disclosure.
No verified public proof-of-concept code is available. See the Adobe Security Advisory for Dreamweaver for vendor technical details.
Detection Methods for CVE-2026-47907
Indicators of Compromise
- Dreamweaver process (Dreamweaver.exe on Windows, Dreamweaver on macOS) reading files outside its installation directory and the user's known project folders
- Inbound Dreamweaver project files, templates, or site definition files received from untrusted email or messaging sources
- Unexpected outbound network traffic from Dreamweaver immediately after opening a document, suggesting exfiltration of read file contents
Detection Strategies
- Monitor endpoint telemetry for Dreamweaver file open events followed by access to sensitive paths such as ~/.ssh, %APPDATA%, or credential stores
- Hunt for Dreamweaver child processes or file reads that deviate from baseline user project activity
- Inspect Dreamweaver project files received via email attachments for absolute or traversal-style path references prior to opening
Monitoring Recommendations
- Alert on Dreamweaver versions 21.7 or earlier remaining in the environment after the patch release
- Track file integrity and access events on directories containing credentials, SSH keys, and source repositories accessed by the Dreamweaver process
- Correlate user reports of suspicious Dreamweaver files with endpoint logs to identify targeted delivery attempts
How to Mitigate CVE-2026-47907
Immediate Actions Required
- Upgrade Adobe Dreamweaver Desktop to the version released in Adobe security bulletin APSB26-62 or later
- Instruct users to refuse Dreamweaver project files, templates, and site definition files from untrusted or unsolicited sources
- Inventory all systems running Dreamweaver and prioritize patching for users handling sensitive credentials or source code
Patch Information
Adobe addressed CVE-2026-47907 in the security update tracked under bulletin APSB26-62. Refer to the Adobe Security Advisory for Dreamweaver for the fixed version number, download locations, and platform-specific installers. Apply the update through Adobe Creative Cloud Desktop or the enterprise deployment toolkit.
Workarounds
- Restrict Dreamweaver execution to dedicated workstations that do not store credentials, SSH keys, or sensitive source repositories
- Apply application allowlisting to prevent Dreamweaver from reading sensitive directories using OS-level controls such as macOS TCC restrictions or Windows AppLocker file access rules
- Configure email and collaboration gateways to quarantine Dreamweaver project file extensions until the patch is fully deployed
# Verify installed Dreamweaver version on macOS
defaults read "/Applications/Adobe Dreamweaver 2021/Adobe Dreamweaver 2021.app/Contents/Info.plist" CFBundleShortVersionString
# Verify installed Dreamweaver version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Dreamweaver*" } | Select-Object DisplayName, DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
