BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-12

Assigner: Adobe Systems Incorporated

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61808

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	coldfusion	2021.22
adobe	coldfusion	2023.16
adobe	coldfusion	2025.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an Unrestricted Upload of File with Dangerous Type in ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. It allows a high privileged attacker to upload files without restriction, potentially leading to arbitrary code execution. Exploiting this vulnerability does not require any user interaction and changes the security scope.

Impact Analysis

The vulnerability can lead to arbitrary code execution by a high privileged attacker, which means an attacker could run malicious code on the affected system. This can compromise confidentiality, integrity, and availability of the system and data, potentially leading to severe security breaches.

Hi! I’m here to help you understand CVE-2025-61808. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70