EUVD-2026-35832
GHSA-9pw3-ggm9-46qq
Severity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Adjacent vector and mandatory user interaction are both confirmed; no privileges required; scope change reflects host-OS-level impact beyond ColdFusion process boundary.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Path traversal in Adobe ColdFusion 2023 (through update 17) and 2025.8 and earlier enables a security feature bypass that exposes files and directories outside intended access boundaries, with a scope change indicating impact extends beyond the ColdFusion process itself. The CVSS vector (AV:A/S:C/C:H/I:H/A:H) signals that a successful exploit can yield full confidentiality, integrity, and availability compromise of affected systems. No public exploit code has been identified and EPSS sits at 0.02% (7th percentile), but the SSVC technical impact rating of 'total' and Adobe PSIRT's own advisory (APSB26-64) confirm the theoretical severity is real.
Technical ContextAI
Adobe ColdFusion is a server-side rapid application development platform built on Java, commonly deployed in enterprise and government web environments. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the ColdFusion file-handling subsystem fails to canonicalize or adequately restrict user-supplied path tokens - such as directory traversal sequences - before resolving them against the filesystem. The scope change (S:C in CVSS) suggests that once the path traversal bypasses ColdFusion's sandbox or security manager, the attacker can reach resources governed by the host OS or adjacent services, not just ColdFusion's own data. CPE data confirms all ColdFusion 2023 releases from baseline through Update 17 are affected, as well as the 2025 release line through 2025.8.
RemediationAI
Apply the vendor-released patch per Adobe security advisory APSB26-64 (https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html). The description implies fixed versions are those after ColdFusion 2023 Update 17 and ColdFusion 2025.8, but the exact patched release designations are not independently confirmed in the available data - consult the APSB26-64 advisory for the precise target update versions before patching. As a compensating control, restrict ColdFusion server network access to trusted network segments only, reducing the adjacent-network attack surface (AV:A); this limits which hosts can reach the vulnerable service. Additionally, implement egress controls on ColdFusion processes to prevent unauthorized filesystem traversal from affecting downstream systems - this addresses the scope-change risk. User awareness to avoid opening unexpected ColdFusion-processed files from untrusted sources reduces the UI:R exploit dependency.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today