Summary
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe ColdFusion versies 25.9, 23.20 en eerdere versies.
Details
Interpretaties
De kwetsbaarheden in Adobe ColdFusion betreffen onder andere onbeperkte upload van gevaarlijke bestandstypen, improper input validation, path traversal, reflected Cross-Site Scripting (XSS) en Server-Side Request Forgery (SSRF). Deze kwetsbaarheden maken het mogelijk voor een aanvaller om zonder enige gebruikersinteractie willekeurige code uit te voeren, bestanden te lezen of te schrijven, en beveiligingsmaatregelen te omzeilen. De path traversal kwetsbaarheden kunnen leiden tot toegang tot en wijziging van bestanden buiten de bedoelde directories. De XSS-kwetsbaarheid ontstaat door onvoldoende sanering van gebruikersinvoer in URL's, waardoor kwaadaardige scripts kunnen worden geïnjecteerd en uitgevoerd in de browser van een gebruiker. De SSRF-kwetsbaarheid stelt een aanvaller in staat om server-side verzoeken te manipuleren en ongeautoriseerde toegang tot bronnen te verkrijgen. Deze problemen zijn aanwezig in meerdere versies van ColdFusion, wat wijst op een breed impactgebied binnen de productlijn.
Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden in ColdFusion te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 11
-
Critical 10.0
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of thi…
KEV Jul 7, 2026 -
Critical 10.0
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user…
-
Critical 10.0
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is…
-
Critical 10.0
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is…
-
Critical 10.0
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user…
-
Critical 10.0
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is…
-
Critical 9.3CVE-2026-48313 Scanner template
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit t…
-
Critical 9.3
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scrip…
-
High 8.8
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution i…
-
High 8.6
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized …
-
Medium 6.5
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to ga…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://helpx.adobe.com//security/products/coldfusion/apsb26-68.html