External risk intelligence

Adobe XD Path Traversal Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2019-7105

Adobe XD is a desktop-based design and prototyping application. It is client-side software intended for local user environments and does not function as a network-facing service, edge gateway, or web-accessible application in standard deployments.

Path Traversal

Adobe Xd

before 17.0.12

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability was identified in Adobe XD that could allow attackers to execute arbitrary code. While the direct business impact may be limited due to the nature of the affected software, confirming its relevance and exposure within the organization is important.

Design software has a serious security flaw.
This could allow unauthorized code execution.
Confirm if your design tools are affected.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a path traversal vulnerability in Adobe XD by tricking a user into opening a specially crafted file. This could allow the attacker to execute arbitrary code on the user's system.

Requires user to open a malicious file.
Path traversal in file parsing.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to read, modify, or delete files on the system, potentially leading to arbitrary code execution when a user opens a specially crafted file.

System files and user data may be affected.
Malicious files could be opened by users.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Adobe XD installations. The first step is to identify where XD is deployed, confirm its reachability and business criticality, and then locate the accountable owner for remediation planning.

App owners should manage this issue.
Verify XD installations and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe XD?

Adobe XD is a desktop application used by designers to create prototypes and user interfaces. Unlike web servers, it runs locally on individual machines to handle design assets, meaning it is typically used for client-side graphic workflows rather than providing network-based services.

What does path traversal mean in CVE-2019-7105?

This vulnerability, classified as CWE-22, occurs when software fails to properly sanitize file paths. In this specific case, it allows an attacker to manipulate how the application reads or accesses files, which can be leveraged to execute unauthorized code on the host machine.

How does an attacker trigger CVE-2019-7105?

The vulnerability is triggered when a user opens a specially crafted, malicious file within the Adobe XD application. Simply having the software installed does not trigger the flaw; the application must actively parse a compromised design file to initiate the unauthorized behavior.

Is Adobe XD at risk from the internet?

According to Halo Surface Signal, this software is very unlikely to be exposed to network threats because it is a desktop-based design tool. It does not act as a web-facing service or edge gateway, so it typically does not present an internet-facing attack surface.

What should I do if I use Adobe XD?

Start by identifying all systems where Adobe XD is currently installed. Once you have an inventory of these devices, coordinate with the appropriate application owners to verify their versions and prioritize updating the software to a version beyond 17.0.12 to mitigate the risk.

References

helpx.adobe.com/security/products/xd/apsb19-22.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.