Technical impact
ColdFusion’s path handling fails to restrict file access strictly to intended directories, allowing an attacker to craft a request that references files outside the allowed scope. This path traversal flaw can be triggered without any user interaction and results in arbitrary reading of sensitive files or directories on the server’s filesystem. The vulnerability escalates the original scope, potentially granting access to files that should be hidden from the application.
Affected Systems
Adobe ColdFusion 2023 and 2025 versions are affected by this flaw. Any installations of these versions that have not applied the vendor’s latest security updates are vulnerable.
Risk and Exploitability
The CVSS score of 9.9 indicates a high severity, and the EPSS score of 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is to alter a file path parameter in a request to navigate above the intended directory boundary; this conclusion is inferred from the description, as the CVE data does not explicitly state the attack method.
