What is the CVSS score of CVE-2025-61823?

CVE-2025-61823 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Adobe ColdFusion CVE-2025-61823

MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2025-12-10 psirt@adobe.com

Java XXE Coldfusion

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

6.2 MEDIUM

XXE file read reachable over the network but gated by admin-level privilege (PR:H) and required user interaction (UI:R); scope change from cross-context file/SSRF access, confidentiality-only impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 23:56 vuln.today

DescriptionCVE.org

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.

AnalysisAI

Arbitrary file system read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier results from an Improper Restriction of XML External Entity Reference (CWE-611) flaw in ColdFusion's XML parsing, which lets an attacker coerce the parser into resolving crafted external entities and disclose sensitive files from the server's file system. Exploitation is doubly gated per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N: the attacker must already hold high (administrative-level) privileges and a legitimate user must interact by submitting or processing attacker-influenced XML, and the scope change (S:C) means the resulting read can reach resources beyond the directly vulnerable component. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.49% (40th percentile), and Adobe has published a fix in security bulletin APSB25-105.

Technical ContextAI

The root cause is CWE-611, Improper Restriction of XML External Entity Reference: ColdFusion's XML parser does not disable external entity (and potentially external DTD/schema) resolution, so a document containing a DOCTYPE declaration with a SYSTEM or PUBLIC entity that points at a local resource (for example file:///etc/passwd or a Windows configuration path) is resolved by the parser and its contents returned or embedded in the resulting response. The CVSS vector confirms this is a confidentiality-only impact (C:H/I:N/A:N) delivered over the network (AV:N) with low attack complexity (AC:L), but it explicitly requires high privileges (PR:H) and user interaction (UI:R), and it is scored with scope change (S:C), meaning the impacted resource is not treated as the same security authority as the vulnerable component. The affected CPE set identifies Adobe ColdFusion in the 2021 track across the base release and update1 through update17 (cpe:2.3:a:adobe:coldfusion:2021 and its update1..update17 flavors), consistent with the advisory language that 2025.4, 2023.16, 2021.22 and all earlier updates are vulnerable - i.e., the entire update ladder below the fixed builds across all three supported trains.

RemediationAI

Primary remediation is to apply the ColdFusion update referenced in Adobe security bulletin APSB25-105 (https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html), which addresses this issue - update the 2025.x, 2023.x and 2021.x installation to the fixed build named for your update track in that bulletin; patch status is 'Patch available per vendor advisory' and Adobe's PSIRT (psirt@adobe.com) is the reporting source. Until the update is applied, deploy compensating controls that directly counter the XXE primitive: configure the JVM used by ColdFusion to disable external entity and external DTD/schema resolution (for example the javax.xml.accessExternalDTD and javax.xml.accessExternalSchema properties, XMLConstants.FEATURE_SECURE_PROCESSING, and the JDK entityExpansionLimit settings in jvm.config), with the trade-off that applications legitimately relying on remote DTDs or XML schemas may fail to parse and will need local copies of those definitions. Also restrict the ColdFusion service account's file system read permissions to only the directories the application requires (trade-off: over-restrictive ACLs can break logging, caching, or file-upload features), and tighten the administrative surface that the PR:H vector depends on - limit who holds ColdFusion Administrator credentials, restrict network access to the Administrator console and administrative APIs, and monitor XML payloads for DOCTYPE/SYSTEM/PUBLIC entity declarations as a detection measure. Note that because the vector requires prior high-privilege authentication plus user interaction, reducing the population of administrator accounts and auditing XML-handling workflows are meaningful interim risk reductions rather than mere generic hardening.