An improperly limited pathname in Adobe ColdFusion introduces a path traversal weakness (CWE‑22) that can lead to arbitrary code execution in the context of the current user. Because the flaw alters the scope, the compromise can affect the entire application and the underlying system. The vulnerability directly threatens confidentiality, integrity, and availability by enabling an attacker to read, modify, or delete arbitrary files and execute malicious code.

Adobe ColdFusion versions 2025.9 and 2023.20 and all earlier releases are affected. The problem is present in every installation of these releases unless patched or upgraded.

The CVSS score of 10 indicates maximum severity, and with no user interaction required the exploit can be performed from any networked location that can reach the ColdFusion server. While the EPSS score is not available, the lack of mitigation in the current releases and the high CVSS suggest a high likelihood of exploitation. The flaw is not yet listed in CISA KEV, but its impact warrants urgent action. The attack vector is inferred to be a remote web request that provides a specially crafted pathname to a ColdFusion resource, which the server then resolves outside the intended directory.