ColdFusion allows an attacker to upload a file with a dangerous type without restriction, enabling arbitrary code execution in the context of the current user. This flaw can be exploited without any user interaction and changes the security scope, meaning privileges may be widened. The vulnerability is classified as CWE‑434, indicating that the application fails to validate the file type during upload.

The vulnerability affects Adobe ColdFusion 2023 and Adobe ColdFusion 2025. No additional version details are provided, so all releases of these product lines are potentially impacted.

The CVSS score of 10.0 marks it as critical, yet the EPSS score of less than 1% suggests that exploitation is currently rare. The issue is not listed in the CISA KEV catalogue. Attackers can likely exploit the flaw by sending a crafted upload request directly to the application, which processes the file as executable content on the server.