Adobe ColdFusion Unrestricted File Upload Vulnerability Leading to Arbitrary Code Execution

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in Adobe ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier. This vulnerability could enable a high-privileged attacker to execute arbitrary code. Exploitation does not require user interaction, and the vulnerability alters the scope of access.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server where ColdFusion is running.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.