Compliance Impact

This vulnerability allows an attacker to perform arbitrary file system reads by exploiting a path traversal flaw, potentially exposing sensitive files and directories outside the intended access scope.

Exposure of sensitive files due to this vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and protected health information.

Therefore, if exploited, this vulnerability could result in unauthorized disclosure of sensitive data, impacting an organization's ability to meet compliance requirements related to confidentiality and data protection.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects ColdFusion versions 2023.18, 2025.6, and earlier. It is a Path Traversal vulnerability caused by improper limitation of a pathname to a restricted directory. An attacker can exploit this flaw to read arbitrary files on the file system, including sensitive files and directories that should be inaccessible.

The exploitation does not require any user interaction, meaning an attacker can trigger it remotely without needing a victim to perform any action.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files and directories outside the intended access scope. This could expose confidential information, configuration files, or other critical data stored on the server.

Since the vulnerability allows arbitrary file system read without user interaction, it increases the risk of data leakage and could be used as a stepping stone for further attacks.

Useful 0 Not Useful 0