Critical Β· published June 30, 2026
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.
π¨ A sneaky path traversal vulnerability in ColdFusion could let attackers execute code without breaking a sweat! π₯ Think of it like a delivery driver who, thanks to an open back door, can access any package in the warehouse without anyone noticing β they just wander right in! This could be absolutely devastating! An attacker could gain control over your system, executing arbitrary code with the privileges of the current user β potentially leading to data loss, manipulation, or even service downtime. If youβre using vulnerable versions, the consequences could be severe!
Think of it like a delivery driver who, thanks to an open back door, can access any package in the warehouse without anyone noticing β they just wander right in! ColdFusion versions 2025.9, 2023.20, and earlier have an improper limitation on pathname handling, allowing attackers to traverse directories and execute arbitrary code without user interaction.
This could be absolutely devastating! An attacker could gain control over your system, executing arbitrary code with the privileges of the current user β potentially leading to data loss, manipulation, or even service downtime. If youβre using vulnerable versions, the consequences could be severe! Immediately patch your ColdFusion installations to the latest version to mitigate this vulnerability. If you're running affected versions, ensure you also review user permissions and configurations, and consider applying additional security layers. Don't wait! This is fixable! Follow these steps, and you'll have your ColdFusion environment secured in no time! π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |
| adobe/coldfusion | all versions | β |