Improper XXE in Adobe ColdFusion

Executive Summary

This vulnerability affects ColdFusion versions 2023.19, 2025.8, and earlier. It is an Improper Restriction of XML External Entity Reference (XXE) vulnerability. An attacker can exploit this by tricking a user into opening a malicious file, which then allows the attacker to read arbitrary files on the system outside the intended access scope.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to read arbitrary files on the file system by exploiting an XML External Entity (XXE) flaw, potentially exposing sensitive information outside the intended access scope.

Exposure of sensitive files could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and protected health information.

Therefore, if exploited, this vulnerability could compromise compliance with these standards by enabling unauthorized access to sensitive data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive files and directories on the affected system. This could expose confidential information and potentially compromise the security of the system. Exploitation requires user interaction, specifically opening a malicious file.

Useful 0 Not Useful 0