What is the CVSS score of CVE-2026-48314?

CVE-2026-48314 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe ColdFusion CVE-2026-48314

EUVD-2026-40341 MEDIUM

Path Traversal (CWE-22)

2026-06-30 adobe

GHSA-pj9j-jvjx-fff5

Path Traversal Adobe Coldfusion

6.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth per vendor CVSS; limited partial file read/write with no availability impact matches description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:20 vuln.today

CVE Published

Jun 30, 2026 - 15:11 cve.org

MEDIUM 6.5

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited read and write access to unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.

AnalysisAI

Path traversal in Adobe ColdFusion 2025.9 and 2023.20 (and earlier) allows unauthenticated remote attackers to bypass path restrictions and gain limited read and write access to files and directories outside the intended web root. The vulnerability is classified as a security feature bypass under CWE-22, exploitable over the network without user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low-complexity, zero-authentication attack surface makes it attractive for opportunistic actors targeting ColdFusion deployments.

Technical ContextAI

Adobe ColdFusion is an enterprise application server and scripting platform used heavily in government and corporate environments. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) occurs when user-supplied path components - such as '../' sequences or encoded traversal characters - are not fully normalized or validated before being used in file system operations, allowing attackers to escape the intended directory boundary. The affected CPE is cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:* covering all ColdFusion variants through 2025.9 (2025 release line) and 2023.20 (2023 release line). The CVSS vector AV:N/AC:L/PR:N confirms the traversal is reachable directly via network-exposed ColdFusion endpoints without any authentication, which is the more serious variant of path traversal - no prior foothold is needed.

RemediationAI

Apply the vendor-released patches detailed in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); consult that advisory for the specific fixed version numbers in the 2025 and 2023 release tracks, as exact patch versions were not included in the available intelligence data. If immediate patching is not possible, restrict external network access to ColdFusion admin interfaces and application endpoints using a web application firewall (WAF) configured to block path traversal patterns (encoded and unencoded '../' sequences); note that WAF rules are a compensating control, not a substitute, and may be bypassed by novel encoding. Additionally, enforce least-privilege file system permissions on the ColdFusion application process account so that even if traversal succeeds, access to sensitive files (credentials, configuration, certificates) is limited. Monitor ColdFusion access logs for anomalous file path patterns in request URIs.