Adobe ColdFusion OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing OS command injection has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This issue arises from improper neutralization of special elements used in OS commands, potentially leading to arbitrary code execution. A low-privileged attacker with local access could exploit this vulnerability to bypass security protections and execute code. The exploitation requires user interaction, as a victim must be coerced into performing actions within the application.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the affected system.