Adobe ColdFusion OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing OS command injection has been identified in Adobe ColdFusion versions 2025.1, 2023.13, and 2021.19 and earlier. This vulnerability arises from improper neutralization of special elements used in OS commands, potentially leading to arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this issue to bypass security mechanisms and execute malicious code, without requiring user interaction.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the affected system, allowing an attacker to execute malicious code with the privileges of the current user.