ColdFusion versions 2025.9, 2023.20 and any earlier releases are susceptible to an unrestricted file upload flaw that permits the uploading of files with dangerous types. This weakness can lead to arbitrary code execution in the context of the current user. Because the attack does not require user interaction and the scope is altered, a successful exploit allows the attacker to gain the privileges of the application or server process, potentially compromising the entire system.

The vulnerability affects Adobe ColdFusion across all versions up to and including 2025.9 and 2023.20. No specific sub‑product or edition is excluded, so all typical ColdFusion deployments running those releases are impacted. Vendors should verify that their installations match these version numbers.

The CVSS score of 10 indicates a critical risk level. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the zero‑interaction nature and scope change suggest a high likelihood of exploitation in active environments. The vulnerability is not listed in the CISA KEV catalog, yet the severity warrants immediate attention.