ColdFusion versions 2023.19, 2025.8 and all earlier releases contain an improper restriction of XML External Entity references, allowing an attacker to read arbitrary files on the server filesystem. The vulnerability enables disclosure of sensitive files and directories beyond the intended application scope, potentially compromising confidentiality. The attack requires user interaction, specifically that a victim opens a crafted malicious file. No elevation of privileges or denial of service conditions are described by the vendor. The flaw is catalogued as CWE-611.

Adobe ColdFusion servers running any of the affected releases – 2023.19 and 2025.8 as well as any legacy versions released before or equal to these. The issue has been disclosed by Adobe in their ColdFusion security advisory, and the referenced advisory lists the vulnerable releases. No additional vendor product line or platform data is provided.

The CVSS score of 7.4 indicates high severity, and while no EPSS score is available, the requirement for user interaction lowers the probability of mass exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploits. Attackers can exploit it by distributing a malicious XML file that references external entities, which a susceptible ColdFusion deployment will resolve and thereby leak sensitive filesystem data. Defensive measures must therefore focus on applying vendor fixes and tightening XML external entity handling.