EUVD-2026-44549
GHSA-37fj-538x-3px9
Severity by source
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Adjacent network vector and low privilege required align with a server-side path traversal needing authenticated adjacent access; scope change reflects OS-boundary file reads with no integrity or availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Path traversal in Adobe ColdFusion 2023 (up to Update 21) and ColdFusion 2025 (up to Update 10) enables a low-privileged attacker on an adjacent network to read arbitrary files outside the intended application directory, with scope change indicating access can extend beyond the ColdFusion process boundary to OS-level files. The CVSS vector (AV:A/PR:L/S:C/C:H) reflects that while high confidentiality impact is possible, exploitation is gated by both network adjacency and authenticated access, meaningfully constraining the realistic attacker pool. No public exploit identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC exploitation status of 'none' further indicate low current exploitation pressure.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes a class of vulnerability where application logic fails to canonicalize or sanitize file path inputs, allowing directory traversal sequences (e.g., '../') or absolute path references to escape the intended document root or sandbox boundary. Adobe ColdFusion is an application server and rapid development platform historically popular in enterprise and government environments. Affected products per CPE are explicitly cpe:2.3:a:adobe:coldfusion:2023 (base release through update17 in NVD CPE data, extended to update21 per EUVD). The CVSS scope change (S:C) is significant: it indicates the vulnerability allows the attacker to reach resources controlled by a security authority other than ColdFusion itself - in practice, files owned by the underlying OS or other co-located applications - amplifying confidentiality impact from a ColdFusion-bounded read to a potential full host-level file disclosure.
RemediationAI
Upgrade Adobe ColdFusion 2023 to Update 22 or later; upgrade Adobe ColdFusion 2025 to Update 11 or later - these are the confirmed fix versions per EUVD EUVD-2026-44549 and the Adobe APSB26-82 advisory at https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html. If immediate patching is not feasible, restrict network-layer access to the ColdFusion server so that only explicitly trusted hosts on the adjacent network can reach it - this directly addresses the AV:A attack vector and eliminates the exploitation path for untrusted adjacent network peers. Additionally, enforce strict ColdFusion sandbox policies to limit the file system paths the server process can access, reducing the blast radius of any traversal attempt. Note that sandbox restrictions may require regression testing of legitimate application functionality that reads files from non-default paths.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a fi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today