Adobe ColdFusion XXE Vulnerability Allowing Arbitrary File System Read

A vulnerability allowing improper restriction of XML external entity references (XXE) has been identified in Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. This vulnerability could lead to arbitrary file system read, allowing attackers to access sensitive files on the server. Exploitation of this issue does not require user interaction and changes the scope of the attack.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files on the server.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion Security Bulletin APSB25-105.