EUVD-2026-42906
GHSA-frv8-q5jq-3qhq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring victim to click a crafted link (UI:R); scope changes to victim browser (S:C), enabling session theft (C:L) and unauthorized admin actions (I:L); no server availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.
AnalysisAI
Reflected XSS in Lucee CFML Server (versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding script payloads within the URL request path, which the server reflects in its response without output encoding. The primary high-impact scenario targets the Lucee administrative interface - if an administrator visits the crafted URL, the attacker can hijack the admin session or trigger unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation; no public exploit identified at time of analysis indicating widespread active exploitation, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Lucee is an open-source CFML (ColdFusion Markup Language) application server implemented in Java, used as an alternative to Adobe ColdFusion for running CFML-based web applications. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS), where attacker-controlled data in the HTTP request path is incorporated into the server's HTTP response without proper context-aware output encoding. Because the malicious content is in the URL path segment rather than a query parameter, server-side defenses that only sanitize query strings may fail to catch the injection point. The CPE string cpe:2.3:a:lucee:lucee:*:*:*:*:*:*:*:* with a wildcard version confirms the flaw spans all versioned branches currently tracked (5.3.x, 6.1.x, 6.2.x, 7.0.x). The CVSS 4.0 subsequent-system confidentiality impact rating of High (SC:H) reflects that the browser execution context - including stored credentials, session tokens, and DOM state for the admin interface - is fully exposed to the injected script.
RemediationAI
No exact patched version is confirmed in the available intelligence data; organizations must monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/lucee-cfml-server-reflected-xss-via-url-path-parsing and Lucee's official release channel for a security fix addressing CVE-2026-29519. Patch availability per vendor advisory should be verified before assuming remediation is available. As the highest-priority compensating control, restrict access to the Lucee administrative interface to trusted IP ranges using firewall rules or reverse-proxy ACLs - this directly addresses the highest-impact scenario (admin session hijacking) by preventing untrusted users from reaching the interface where reflected content could be weaponized. Deploying a Web Application Firewall rule to detect and block common XSS patterns in URL path segments provides an additional layer, though WAF rules can be bypassed via encoding variations and should not be treated as a complete fix. Administrators should also implement Content Security Policy (CSP) response headers on the Lucee admin interface to limit the capabilities of any successfully injected scripts; note that CSP misconfiguration can reduce its effectiveness, so header values should be reviewed carefully.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today