CVE-2026-48282
Description
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Summary dbcve.org
ColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal vulnerability that allows attackers to access files outside the restricted directory through manipulated path inputs, leading to arbitrary code execution in the context of the current user. No user interaction is required for exploitation, and the CVSS scope change indicates the vulnerability impacts components beyond the original security boundary.
Mitigation
Immediately restrict file path inputs through strict allow-list validation, implement proper path canonicalization to resolve symlinks and relative paths, and apply Adobe's security patches for the affected ColdFusion versions. Until patched, disable unnecessary file operation endpoints.