CVE-2026-48282KEV Β· OVERDUECWE-22path-traversal

Adobe ColdFusion Path Traversal Vulnerability

Critical Β· published June 30, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

105
days past CISA
deadline
CVSS v3.1
10.0
EPSS
42%
Percentile
98.7
In the wild
Confirmed
What it is

🚨 A sneaky path traversal vulnerability in ColdFusion could let attackers execute code without breaking a sweat! πŸ”₯ Think of it like a delivery driver who, thanks to an open back door, can access any package in the warehouse without anyone noticing β€” they just wander right in! This could be absolutely devastating! An attacker could gain control over your system, executing arbitrary code with the privileges of the current user β€” potentially leading to data loss, manipulation, or even service downtime. If you’re using vulnerable versions, the consequences could be severe!

Put simply

Think of it like a delivery driver who, thanks to an open back door, can access any package in the warehouse without anyone noticing β€” they just wander right in! ColdFusion versions 2025.9, 2023.20, and earlier have an improper limitation on pathname handling, allowing attackers to traverse directories and execute arbitrary code without user interaction.

What to do

This could be absolutely devastating! An attacker could gain control over your system, executing arbitrary code with the privileges of the current user β€” potentially leading to data loss, manipulation, or even service downtime. If you’re using vulnerable versions, the consequences could be severe! Immediately patch your ColdFusion installations to the latest version to mitigate this vulnerability. If you're running affected versions, ensure you also review user permissions and configurations, and consider applying additional security layers. Don't wait! This is fixable! Follow these steps, and you'll have your ColdFusion environment secured in no time! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
10.0 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.42388 Β· 98.7th percentile
Weakness
CWE-22 Β· Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-30T20:16Z
KEV added
2026-07-07 Β· due 2026-07-10
Affected products (31)
ProductVersionsFixed in
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
adobe/coldfusionall versionsβ€”
References (2)
EPSS history
Timeline
  • 07 JUL 00:00Z
    Added to CISA KEV β€” remediate by Jul 10
    kev
  • 30 JUN 15:11Z
    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
    cvelistv5