CVE-2026-47909: Dreamweaver Arbitrary File Read via Input Validation Flaw

Technical summary

CVE-2026-47909 is an improper input validation vulnerability (CWE-20) in Adobe Dreamweaver Desktop affecting versions 21.7 and earlier on Windows and macOS. The flaw allows unauthenticated local attackers to read arbitrary files from the host system by crafting a malicious file that, when opened by a victim in Dreamweaver, bypasses input validation controls. The vulnerability results in a scope change (CWE-20 with elevated impact), meaning the attacker can access resources beyond what the application normally protects. The attack vector is local (AV:L), requires no special privileges (PR:N), has low complexity (AC:L), and necessitates user interaction (UI:R) to open the malicious file.

Business impact

This vulnerability poses a confidentiality risk to organizations using Dreamweaver Desktop for web development. Attackers can harvest sensitive information—source code, configuration files, API keys, credentials stored in the user's home directory, or other intellectual property—by distributing malicious files via phishing, watering hole, or supply-chain-adjacent methods. The attack does not enable file modification or system destruction, but the disclosure of sensitive design or business data can lead to competitive harm, compliance violations, or secondary attacks. Teams relying on Dreamweaver for client projects face additional risk if they handle third-party files from untrusted sources.

Affected systems

Adobe Dreamweaver Desktop versions 21.7 and earlier running on Windows or macOS are affected. The vulnerability is local-attack only, so exposure is limited to users who actually run the vulnerable software and interact with attacker-controlled files. Developers, web designers, and creative teams using Dreamweaver in these versions are at risk. Later versions of Dreamweaver (above 21.7) are not affected, provided they contain the necessary input validation fixes.

Exploitability

Exploitability is moderate. The attack requires user interaction—the victim must be persuaded to open a malicious file in Dreamweaver. There is no network component, no privilege escalation needed, and the attacker needs no prior access. However, successful exploitation depends on social engineering effectiveness. The file must be crafted to trigger the input validation bypass without raising user suspicion. The CVSS score of 6.3 (MEDIUM) reflects this balance: high confidentiality impact but user-interaction dependency and local scope. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting it has not yet been weaponized in widespread attacks, though this does not guarantee immunity.

Remediation

Users and administrators should update Dreamweaver Desktop to a version later than 21.7 as soon as vendor patches are available. Adobe has not yet published specific patch versions in the provided advisories, so verify the latest available release through the official Adobe website or the Creative Cloud application. Until patched, organizations should restrict file-opening workflows: implement controls to prevent users from opening files from untrusted sources in Dreamweaver, and educate teams on the risks of opening unsolicited project files or archives. Consider using application sandboxing or execution controls on development machines to limit file system access.

Patch guidance

Monitor Adobe's security advisories for release of patched Dreamweaver Desktop versions. Updates above version 21.7 should address the input validation flaw. Deploy patches via Adobe Creative Cloud's automatic update mechanism or through manual downloads from Adobe's official site. Verify patch status by checking the version number in Dreamweaver's About dialog (typically Help > About Dreamweaver). Test patched versions in a non-production environment before full rollout to ensure compatibility with active projects and plugins. Maintain an inventory of Dreamweaver installations across your organization to track remediation progress.

Detection guidance

Monitor file-opening activity in Dreamweaver through endpoint detection and response (EDR) tools. Look for unusual file access patterns—particularly reads of sensitive system directories or home directory contents—correlated with Dreamweaver process execution. File integrity monitoring can flag unexpected access to .env files, API key stores, or source code repositories. Network-based detection is limited since this is a local attack, but email and file-transfer monitoring can identify delivery of suspicious project files. Educate developers to report unusual behavior when opening files in Dreamweaver (unexpected file dialogs, sluggish performance, or access permission prompts). Log and audit which files are opened in Dreamweaver on sensitive systems.

Why prioritize this

This vulnerability merits timely but not emergency patching. The MEDIUM CVSS score (6.3) and user-interaction requirement prevent it from being critical, but the high confidentiality impact and the fact that source code and credentials are routine targets make it a priority for development teams. The lack of KEV designation suggests no active exploitation in the wild currently, but exploitation is technically feasible. Prioritize patching for Dreamweaver instances that handle proprietary code, client projects, or systems where developers store credentials in accessible locations. Standard enterprise patch cycles (within 30 days) are appropriate; accelerate to 2–3 weeks for high-value development environments.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) is driven by: (1) High confidentiality impact (C:H)—unrestricted file read access; (2) No integrity or availability impact (I:N/A:N)—files are not modified or deleted; (3) Local attack vector (AV:L)—attacker must already have system access or trick the user into opening a file; (4) Required user interaction (UI:R)—victim must open the malicious file; (5) Low attack complexity (AC:L)—no special conditions needed; (6) No privilege requirement (PR:N); (7) Changed scope (S:C)—impact extends beyond the Dreamweaver security boundary. The user-interaction requirement prevents a higher score despite the high confidentiality impact.

Frequently asked questions