CVE-2026-79904: Adobe Photoshop Mobile Path Traversal Flaw

CVE-2026-79904 Overview

Adobe Photoshop Mobile for Android contains a path traversal vulnerability [CWE-22] that enables a security feature bypass. A low-privileged local attacker can leverage the flaw to access files or directories outside intended restrictions. Exploitation requires user interaction, specifically that a victim opens a malicious file, and depends on conditions beyond the attacker's control.

The issue is tracked in Adobe security bulletin APSB26-136 and affects the Android build of Photoshop Mobile. Successful exploitation can expose unauthorized files, tamper with limited application data, and impact application availability on the affected device.

Critical Impact
A local attacker who convinces a user to open a crafted file can bypass sandbox restrictions and reach files outside the app's intended directory scope.

Affected Products

Adobe Photoshop Mobile for Android (see APSB26-136 for fixed versions)
Application component: adobe:photoshop_mobile
Platform CPE: cpe:2.3:a:adobe:photoshop_mobile:*:*:*:*:*:android:*:*

Discovery Timeline

2026-09-08 - CVE-2026-79904 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79904

Vulnerability Analysis

The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory issue [CWE-22] in Adobe Photoshop Mobile on Android. The application fails to fully constrain file path inputs when processing content supplied by the user or by external sources.

Because the flaw enables a security feature bypass, an attacker can traverse outside the application's expected working directory. The result is unauthorized read access to files, limited integrity impact on application-controlled data, and a potential availability impact on the process handling the malicious input.

Exploitation is not straightforward. Adobe notes that success depends on conditions beyond the attacker's control, and the attacker must already have low-privileged local access to the device or its shared storage.

Root Cause

The root cause is inadequate normalization and validation of pathname components inside Photoshop Mobile's file-handling logic. Sequences such as ../ embedded in filenames or project metadata are not neutralized before the app resolves them against internal storage locations.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Photoshop-compatible file that embeds traversal sequences in file references or archive entries. When the victim opens the file in Photoshop Mobile, the app resolves the crafted paths and reads or writes files outside its designated sandboxed directory. Refer to the Adobe Photoshop Security Advisory (APSB26-136) for vendor-supplied technical context.

Detection Methods for CVE-2026-79904

Indicators of Compromise

Photoshop project or asset files that contain path components with ../, absolute paths, or unusual Unicode separators in embedded references.
File access events by the Photoshop Mobile Android package targeting locations outside the app's private data directory or expected media folders.
Unexpected creation or modification of files in shared Android storage immediately after opening a downloaded design file.

Detection Strategies

Inspect suspicious Photoshop assets in a controlled environment and enumerate embedded file references for traversal sequences before distribution to end users.
Correlate mobile device management (MDM) telemetry for Photoshop Mobile file opens with subsequent access to sensitive directories on the device.
Alert on Photoshop Mobile writing to paths that fall outside its documented sandbox on managed Android devices.

Monitoring Recommendations

Enable verbose file-access auditing on managed Android endpoints and forward logs to a centralized analytics platform for review.
Track installed versions of Adobe Photoshop Mobile across the fleet and flag devices running builds earlier than the fixed release in APSB26-136.
Monitor email and collaboration channels for unsolicited Photoshop project files delivered to mobile users.

How to Mitigate CVE-2026-79904

Immediate Actions Required

Update Adobe Photoshop Mobile on Android to the version listed as fixed in the Adobe Photoshop Security Advisory (APSB26-136).
Instruct users not to open Photoshop project files received from untrusted sources or unexpected senders.
Inventory all managed Android devices with Photoshop Mobile installed and prioritize patch deployment through MDM.

Patch Information

Adobe published fixes for this vulnerability in bulletin APSB26-136. Administrators should consult the Adobe Photoshop Security Advisory for the exact fixed version of Photoshop Mobile for Android and roll out the update through the Google Play managed store or enterprise app distribution.

Workarounds

Restrict Photoshop Mobile installations to managed devices where update policies can be enforced.
Use MDM controls to limit Photoshop Mobile's access to shared storage where feasible until the patched version is deployed.
Block delivery of Photoshop project file types from untrusted external senders at the email gateway.

bash

# Configuration example: query installed Photoshop Mobile version via adb
adb shell dumpsys package com.adobe.psmobile | grep versionName