CVE-2025-61813
BaseFortify
Publication date: 2025-12-10
Last updated on: 2026-04-28
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | coldfusion | 2021.22 |
| adobe | coldfusion | 2023.16 |
| adobe | coldfusion | 2025.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Restriction of XML External Entity Reference (XXE) in ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. It allows an attacker to exploit XML processing to read arbitrary files on the server without requiring user interaction.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could access sensitive files on the server, potentially leading to exposure of confidential information. This could compromise data confidentiality and may allow further attacks based on the information obtained.