Path Traversal in Adobe ColdFusion

Executive Summary

This vulnerability affects ColdFusion versions 2023.19, 2025.8, and earlier. It is an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This means an attacker can bypass security features by accessing files or directories outside the intended restricted areas.

To exploit this vulnerability, an attacker needs the victim to open a malicious file, which then allows unauthorized access to sensitive files or directories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to bypass security features and access unauthorized files or directories outside intended restrictions, which could lead to unauthorized disclosure, modification, or destruction of sensitive data.

Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive information.

However, specific impacts on compliance depend on the context of the affected system and data involved.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to a security feature bypass, allowing attackers to access unauthorized files or directories. This can result in the compromise of confidentiality, integrity, and availability of data.

• Confidentiality impact: Attackers may read sensitive files.
• Integrity impact: Attackers may modify or delete files.
• Availability impact: Attackers may disrupt access to files or services.

Useful 0 Not Useful 0