Adobe ColdFusion Path Traversal Vulnerability Leading to Security Feature Bypass

A path traversal vulnerability allowing improper limitation of a pathname to a restricted directory has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This vulnerability could enable a high-privileged attacker to bypass security protections, gaining unauthorized write and delete access. Notably, exploitation of this issue does not require user interaction, and it alters the scope of access.

Impact

Exploitation of this vulnerability could result in unauthorized write and delete access, allowing a high-privileged attacker to bypass security protections and manipulate files or data within the application.