Description

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Severity (CVSS)

Base score9.1
SeverityCritical
VersionCVSS 3.1
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Provided byCNA

Weaknesses

  • CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Affected products

VendorProductVersions
AdobeColdFusion 20250 to <=10; 11
AdobeColdFusion 20230 to <=21; 22

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 15 Jul 2026 07:06 UTC.