ColdFusion versions up to 2025.9 and 2023.20 allow an attacker to upload any file type without restriction, enabling execution of that file in the context of the current user. Because the vulnerability changes scope, the attacker can gain privileges beyond the initial user and run arbitrary code. No user interaction is required.

The affected products are Adobe ColdFusion software versions 2025.9, 2023.20 and all earlier releases. The vulnerability is present in all those releases, regardless of deployment environment.

The CVSS score of 10 highlights the vulnerability as critical. Since execution can occur without any user action, an attacker could exploit a publicly reachable upload endpoint to deliver a malicious script or binary. The lack of an EPSS score is neutral, but the absence from KEV suggests no known public exploitation yet. However, the ability to change scope and run arbitrary code makes it highly dangerous.