Adobe ColdFusion XXE Vulnerability Allowing Arbitrary File System Read

A vulnerability allowing improper restriction of XML external entity references (XXE) has been identified in Adobe ColdFusion. This issue affects ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. The vulnerability could lead to arbitrary file system read, allowing a high privileged attacker to access sensitive files and data on the server. Exploitation of this vulnerability requires user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files and data on the server.

Remediation

Users are advised to update to ColdFusion 2025 Update 5, ColdFusion 2023 Update 17, or ColdFusion 2021 Update 23. For more information on these updates, refer to the Adobe ColdFusion downloads page. Additionally, review the ColdFusion Lockdown Guides for security configuration recommendations.