Adobe ColdFusion suffers an Improper Limitation of a Pathname vulnerability that allows attackers to traverse directory boundaries and read files or directories outside the intended restricted area. The flaw can bypass security controls, exposing sensitive system data or application files. It is classified as a classic directory traversal weakness (CWE‑22).

Adobe ColdFusion versions 2023.18, 2025.6, and all earlier releases are affected by this pathname traversal defect. The vulnerability applies to all product releases prior to the update that contains the fix, as noted in Adobe’s advisory.

The vulnerability carries a CVSS score of 7.7, indicating a moderate to high severity. The EPSS score of 9% shows that exploitation is plausible but not widespread. It is not listed in the CISA KEV catalog. The issue does not require user interaction, and based on the description it is inferred that an attacker could trigger the traversal by crafting an HTTP request to the application’s file handling endpoints, potentially enabling remote read of arbitrary files.