CVE-2025-61809CWE-20

CVE-2025-61809

Critical ยท published December 10, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

๐Ÿ”ฅ An improper input validation vulnerability lurks in ColdFusion versions 2025.4, 2023.16, and 2021.22, making it shockingly easy to bypass security features! ๐Ÿšจ Think of it like a restaurant with a hidden backdoor โ€” if you know the right trick, you can skip right past the hostess and access the kitchen without anyone noticing! This vulnerability could allow an attacker to waltz right in and gain unauthorized read and write access to your sensitive data โ€” absolutely devastating! With no user interaction needed, the risk is dangerously high, leaving your applications wide open for exploitation.

Put simply

Think of it like a restaurant with a hidden backdoor โ€” if you know the right trick, you can skip right past the hostess and access the kitchen without anyone noticing! The flaw stems from ColdFusion failing to properly validate inputs, leading to a potential security feature bypass. Attackers can exploit this to manipulate the application and access data they shouldn't.

What to do

This vulnerability could allow an attacker to waltz right in and gain unauthorized read and write access to your sensitive data โ€” absolutely devastating! With no user interaction needed, the risk is dangerously high, leaving your applications wide open for exploitation. Immediate action is essential: upgrade to ColdFusion version 2025.5 or later to patch this vulnerability. Regularly review your input validation processes as an added layer of protection. You've got this! Act swiftly and you'll have your systems secured in no time! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
9.1 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00661 ยท 51.0th percentile
Weakness
CWE-20 ยท Improper Input Validation
Published
2025-12-10T05:16Z
Affected products (45)
ProductVersionsFixed in
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
References (1)
EPSS history
Timeline
  • 09 DEC 23:41Z
    ColdFusion | Improper Input Validation (CWE-20)
    cvelistv5