CVE-2025-61821
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-12
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | coldfusion | 2021.22 |
| adobe | coldfusion | 2023.16 |
| adobe | coldfusion | 2025.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Restriction of XML External Entity Reference (XXE) in ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. It allows an attacker to exploit XML processing to read arbitrary files on the server's file system without requiring user interaction.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could access sensitive files and data on the server, potentially leading to unauthorized disclosure of confidential information. This could compromise the security and privacy of your systems and data.