ColdFusion’s path handling fails to restrict file access strictly to intended directories, allowing an attacker to craft a request that references files outside the allowed scope. This path traversal flaw can be triggered without any user interaction and results in arbitrary reading of sensitive files or directories on the server’s filesystem. The vulnerability escalates the original scope, potentially granting access to files that should be hidden from the application.

Adobe ColdFusion 2023 and 2025 versions are affected by this flaw. Any installations of these versions that have not applied the vendor’s latest security updates are vulnerable.

The CVSS score of 9.9 indicates a high severity, and the EPSS score of 23% indicates a high likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is to alter a file path parameter in a request to navigate above the intended directory boundary; this conclusion is inferred from the description, as the CVE data does not explicitly state the attack method.