Path Traversal in Adobe ColdFusion

Executive Summary

This vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. It is an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This means an attacker can manipulate file paths to access files and directories outside the intended restricted areas.

Exploitation of this vulnerability allows an attacker to read arbitrary files on the file system and gain limited write access. Importantly, the attacker does not need any user interaction to exploit this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows attackers to access sensitive files and directories that should be protected. This could lead to unauthorized disclosure of confidential information.

Additionally, the attacker can perform limited writes to the file system, which might enable further exploitation or modification of important files.

Since exploitation does not require user interaction and the scope is changed, the risk and potential impact are high.

Useful 0 Not Useful 0