Adobe ColdFusion Improper Input Validation Vulnerability Allowing Security Feature Bypass

A vulnerability has been identified in Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. This vulnerability arises from improper input validation, which could lead to a security feature bypass. An attacker could exploit this issue to circumvent security measures, gaining unauthorized read and write access. The vulnerability does not require user interaction, and the scope remains unchanged.

Impact

Exploitation of this vulnerability could result in unauthorized read and write access, allowing attackers to bypass security features and potentially manipulate files or data within the application.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.