CVE-2026-47907: Dreamweaver Desktop | Improper Access Control (CWE-284)

Synopsis

An improper access control vulnerability affects Adobe Dreamweaver Desktop versions 21.7 and earlier. The flaw is exploited locally and requires no authentication, but a victim must open a malicious file for the attack to succeed. Successful exploitation allows an attacker to read arbitrary files and directories outside the intended access scope, disclosing sensitive data from the host file system. No fix has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required; the attacker needs only the ability to deliver a malicious file to the victim.

• Victim interactionRequired

  A victim must actively open a malicious file, making social engineering or a crafted file delivery a prerequisite for exploitation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable once the malicious file is opened, with no race conditions or special environmental factors required.

Blast Radius

• Attacker reads arbitrary files and directories on the host file system outside the scope Dreamweaver is intended to access.
• Sensitive local data such as stored credentials, configuration files, SSH keys, and application secrets becomes readable to the attacker.
• Because scope is changed, files belonging to other applications or the operating system outside the Dreamweaver sandbox are reachable.