What is the CVSS score of CVE-2026-48313?

CVE-2026-48313 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48313?

Adobe ColdFusion 2025.9, 2023.20, and earlier versions contain a critical unauthenticated path traversal vulnerability (CVSS 9.3) enabling remote attackers to read arbitrary files and execute limited…

Is there a public PoC exploit available for CVE-2026-48313?

Yes, a public proof-of-concept exploit is available for CVE-2026-48313. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-48313?

Within 24 hours: Conduct complete inventory of all ColdFusion instances running version 2023.20, 2025.9, or earlier; identify internet-facing and internally accessible deployments; assess downstream system dependencies on exposed credentials or configuration. Within 7 days: Implement network segmentation restricting ColdFusion to internal-only access; deploy WAF rules blocking path traversal patterns (../, etc.); enable comprehensive file access logging on affected systems. Within 30 days: Monitor Adobe security bulletins for patch release; prepare staged deployment and rollback procedures; execute patching in controlled pilot environment.

Adobe ColdFusion CVE-2026-48313

EUVD-2026-40343 CRITICAL

Path Traversal (CWE-22)

2026-06-30 adobe

GHSA-68pc-wh27-vgm6

Path Traversal Coldfusion

9.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.3 CRITICAL

Network-reachable, unauthenticated, no-interaction traversal yields PR:N/UI:N/AC:L; reading files outside the web-root scope justifies S:C with C:H, limited write I:L, and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:21 vuln.today

CVE Published

Jun 30, 2026 - 15:12 cve.org

CRITICAL 9.3

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary files outside the intended web scope and perform limited writes, with no user interaction required. The scope-change (S:C) and high confidentiality impact drive a 9.3 critical rating, meaning a successful read can expose secrets - configuration, credentials, and source - that compromise components beyond ColdFusion itself. No public exploit is identified at time of analysis and the issue is not in CISA KEV, but ColdFusion's history of weaponized path-traversal and file-disclosure bugs makes prompt patching prudent.

Technical ContextAI

Adobe ColdFusion is a commercial Java-based application server and rapid web-development platform (CFML) historically targeted in attacks against internet-facing servers. The flaw is CWE-22, Improper Limitation of a Pathname to a Restricted Directory, where attacker-controlled path input is insufficiently canonicalized or constrained, allowing '../' style traversal sequences (or absolute paths) to escape the intended directory and resolve filesystem locations outside the web root. The affected component per CPE is cpe:2.3:a:adobe:coldfusion across all version branches up to 2025.9 and 2023.20, and the resulting primitive is arbitrary file read plus limited write, which on ColdFusion typically threatens configuration files, datasource credentials, password hashes, and potentially seed files used for deserialization or admin access.

RemediationAI

Apply the security updates published in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html), upgrading to the fixed update level above 2025.9 and 2023.20 for your respective branch; consult the bulletin for the exact patched build numbers, as Patch available per vendor advisory and the precise fix version should be taken from Adobe rather than assumed. If immediate patching is not possible, reduce exposure by removing the ColdFusion administrator and internal endpoints from internet reachability and placing the server behind a reverse proxy or WAF with rules blocking traversal sequences (encoded and raw '../', absolute paths) - accepting that WAF filtering is bypass-prone and not a substitute for the patch. Additionally apply Adobe's ColdFusion lockdown guidance, run the service under a least-privileged OS account to limit which files traversal can reach, and restrict filesystem permissions on sensitive configuration and seed files; note these controls reduce blast radius but do not close the underlying flaw.