ColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw that allows an unauthenticated attacker to bypass restrictions and read or write files outside the intended protected directories. The vulnerability can grant limited read and write access, exposing sensitive files, configuration data, or enabling further post‑exploitation actions. The flaw is documented as CWE‑22 and does not require user interaction, meaning it can be exploited by any request reaching the vulnerable component.

Adobe ColdFusion is affected. All installations of ColdFusion 2025.9, 2023.20 and earlier are potentially vulnerable. No further version granularity is provided in the advisory.

The CVSS score of 6.5 indicates a moderate impact, while the EPSS score is not available, suggesting no current data on exploitation probability. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending crafted requests to the server’s file handling endpoints, inserting relative path components that traverse outside the allowed directory. Because the flaw operates without any user action, it is achievable remotely via HTTP traffic. The impact is limited to file level access, but it could serve as a foothold for a broader compromise.