Lucee CFML Server allows an unauthenticated attacker to inject and execute arbitrary JavaScript in a victim’s browser. The injected script can hijack sessions or perform unauthorized actions against the Lucee administrative interface, thereby compromising confidentiality and integrity of the web application.

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines are affected. Specific sub‑version details are not enumerated, so any build that belongs to these major release lines is potentially vulnerable.

The CVSS base score of 6.2 signals a moderate risk level. The EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is currently not listed in CISA’s KEV catalog. The likely attack vector is straightforward: an unauthenticated user crafts a URL containing malicious script payloads in the path; the server reflects these payloads in its response without proper output encoding, enabling the script to run in the victim’s browser context.