CVE-2025-61811CWE-22path-traversal

CVE-2025-61811

Critical ยท published December 10, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

๐Ÿšจ A critical access control flaw in ColdFusion could let high-privileged attackers execute arbitrary code without breaking a sweat! ๐Ÿ”ฅ Think of it like a hotel where a guest discovers a hidden door to the manager's office โ€” they can stroll right in, bypassing all the locks and security measures. It's surprisingly easy and devastating for those inside! If exploited, an attacker could unleash chaos: executing any code they want in the context of the current user, potentially leading to data breaches, system takeovers, or even massive service disruptions. With such power, they can manipulate or destroy sensitive information at will!

Put simply

Think of it like a hotel where a guest discovers a hidden door to the manager's office โ€” they can stroll right in, bypassing all the locks and security measures. It's surprisingly easy and devastating for those inside! This Improper Access Control vulnerability in ColdFusion allows attackers to bypass security measures and execute arbitrary code due to inadequate validation of user permissions. Versions 2025.4, 2023.16, and 2021.22 and earlier are at risk, and no user interaction is required for exploitation.

What to do

If exploited, an attacker could unleash chaos: executing any code they want in the context of the current user, potentially leading to data breaches, system takeovers, or even massive service disruptions. With such power, they can manipulate or destroy sensitive information at will! Act fast! Update your ColdFusion to the latest version immediately to close this vulnerability. Implement strict access control measures and regularly review user permissions to prevent unauthorized access. It's crucial to stay ahead of potential threats! You've got this! Follow these steps and you'll have your defenses fortified in no time. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
9.1 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01204 ยท 68.0th percentile
Weakness
CWE-22 ยท Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-10T05:16Z
Affected products (45)
ProductVersionsFixed in
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
adobe/coldfusionall versionsโ€”
References (1)
EPSS history
Timeline
  • 09 DEC 23:41Z
    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
    cvelistv5