Adobe ColdFusion Path Traversal Vulnerability Allowing Arbitrary File System Read

A path traversal vulnerability has been identified in Adobe ColdFusion versions 2025.1, 2023.13, and 2021.19 and earlier. This vulnerability arises from an improper limitation of a pathname to a restricted directory, potentially leading to unauthorized read access of the file system. A high-privileged attacker could exploit this issue to bypass security protections and gain access to sensitive files. The vulnerability can be exploited without user interaction, and it changes the scope of access.

Impact

Exploitation of this vulnerability could result in unauthorized read access to the file system, allowing attackers to access sensitive information or files that should be protected.