ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Adobe |
|
No data.
No data.
References
History
Wed, 15 Apr 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Adobe
Adobe coldfusion |
|
| Vendors & Products |
Adobe
Adobe coldfusion |
Tue, 14 Apr 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. | |
| Title | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: adobe
Published: 2026-04-14T21:53:57.015Z
Updated: 2026-04-14T21:53:57.015Z
Reserved: 2026-02-18T22:02:41.401Z
Link: CVE-2026-27305
Vulnrichment
No data.
NVD
Status : Undergoing Analysis
Published: 2026-04-14T22:16:29.573
Modified: 2026-04-15T16:14:07.857
Link: CVE-2026-27305
Redhat
No data.