EUVD-2026-22732Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
AnalysisAI
Path traversal in Adobe ColdFusion 2023.18, 2025.6 and earlier enables unauthenticated remote attackers to read arbitrary files from the server file system without user interaction. The vulnerability carries a CVSS score of 8.6 (High) due to network accessibility, low complexity, and scope change, allowing access to sensitive files and directories beyond intended boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker against Adobe ColdFusion versions 2023.18, 2025.6 and earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents significant real-world risk for internet-facing ColdFusion deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker identifies a publicly accessible ColdFusion application server and crafts HTTP requests containing path traversal sequences (such as ../../../../etc/passwd or ..\..\..\..\windows\system32\config\sam) in vulnerable parameters. The ColdFusion application processes these malicious paths without proper validation, allowing the attacker to read arbitrary files within the permissions scope of the ColdFusion process. … |
| Remediation | Apply the security updates provided in Adobe Security Bulletin APSB26-38 immediately, prioritizing internet-facing ColdFusion installations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all ColdFusion 2023.18 and 2025.6 instances; restrict network access to ColdFusion administration and application ports using firewall rules or WAF policies; implement request filtering to block path traversal patterns (../, ..\ sequences). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today