Description
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.









RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
Published: 2026-10-13
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary file read via path traversal
Action: Patch Now
AI Analysis

Impact

ColdFusion Remote Development Services (RDS) suffers from an improper limitation of a pathname to a restricted directory, allowing an attacker to read arbitrary files on the server’s file system. The vulnerability can be triggered without user interaction and elevates its scope to the entire system, potentially exposing sensitive configuration files, credentials, or other confidential data.

Affected Systems

Adobe ColdFusion 2023 and 2025 are affected, specifically when RDS is enabled. This feature is intended solely for debugging and should not be present in production environments.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity, and an EPSS score of less than 1% implies that the likelihood of exploitation at the moment is low but not impossible. The vulnerability is not listed in the CISA KEV catalog, yet it remains exploitable from remote locations, making it a significant risk for systems that have RDS enabled.

Generated by OpenCVE AI on October 16, 2026 at 04:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable Remote Development Services by switching the ColdFusion server to Production Secure Profile as described in Adobe’s Lockdown Guide
  • Apply the latest available patch or update for ColdFusion 2023 or 2025 that removes the path traversal flaw in RDS
  • Ensure that RDS is never enabled in production and restrict access to the ColdFusion administration console to authorized personnel

Generated by OpenCVE AI on October 16, 2026 at 04:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe coldfusion 2023
Adobe coldfusion 2025
Vendors & Products Adobe
Adobe coldfusion 2023
Adobe coldfusion 2025

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile. ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
References

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
Title ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Adobe Coldfusion 2023 Coldfusion 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T14:53:07.419Z

Reserved: 2026-09-12T11:06:59.201Z

Link: CVE-2026-90530

cve-icon Vulnrichment

Updated: 2026-10-14T14:45:50.388Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T21:19:57.273

Modified: 2026-10-14T15:50:50.180

Link: CVE-2026-90530

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T20:15:06Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')