A flaw in how ColdFusion processes XML input allows an attacker to misuse XML External Entity (XXE) references so that arbitrary files on the server’s file system can be read. The vulnerability is triggered by a crafted XML payload and does not require the victim to take any user‑initiated action. Because the internal scope is changed, the attacker can access files outside the application’s intended directory structure, exposing sensitive information, configuration files, or credentials that may be stored on the host.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected by this XXE vulnerability. The specific configuration leading to the flaw is not limited to a particular deployment mode; any installation that enables standard XML parsing without proper restrictions is susceptible.

ColdFusion’s score of 8.6 places the issue in the High severity range, and the EPSS score of less than 1 % indicates a very low likelihood of active exploitation as of now. The vulnerability is not listed in the CISA KEV catalog, suggesting that there is no confirmed widespread use of exploitation code in the wild. Attackers can reach the flaw remotely by sending a crafted XML request to the application; no user interaction is required. Once the vulnerability is triggered, the attacker can read any file permitted by the service account under which ColdFusion runs.