This vulnerability permits an attacker to read files outside the intended directory by manipulating a file path accepted by the ColdFusion application. The flaw is a classic path traversal that removes the normal restrictions on the file name, allowing an adversary to access sensitive configuration or credential files. No user interaction is needed; the attacker can trigger the exploitation via an HTTP request that includes a crafted path.

Adobe ColdFusion versions 2023.18 and 2025.6 and all earlier releases are affected. The issue applies to all deployments of ColdFusion using the default configuration that permits file access endpoint exposure.

The CVSS v3.1 score of 8.6 marks this as High severity. Exploitation is straightforward for an unauthenticated attacker through a crafted request, thus the risk to confidentiality is substantial. The EPSS score is not available, and the vulnerability is not yet listed in CISA's KEV catalog, but given the high CVSS and the remote nature of the attack vector, a timely patch is strongly recommended.