Attacking from Within: How Adobe ColdFusion Admins Can Weaponize Remote Shares

Adobe has issued critical updates for ColdFusion after a security researcher uncovered a logic flaw in the ColdFusion Archive (CAR) deployment mechanism that lets authenticated admins weaponise remote shares to load malicious code, tracked as CVE-2025-61808. The flaw exploits improper validation of file paths, enabling the use of Windows UNC paths to load files from remote SMB shares and deploy a web shell directly to the webroot, bypassing normal upload restrictions.

The vulnerability affects ColdFusion 2025 (Update 4 and earlier), ColdFusion 2023 (Update 16 and earlier), and ColdFusion 2021 (Update 22 and earlier); Adobe’s patches restrict where CAR files can be loaded in CF 2025 Update 5, CF 2023 Update 17 and CF 2021 Update 23. According to Brian Reilly, the attacker could be an external actor or a malicious insider who gains access to the CFAdmin console, making admin access a potential full system compromise.

Reilly recommends rigorous network filtering and “fanatically” protecting the admin console, emphasising that strict egress rules can prevent communication with external SMB shares and that keeping CFAdmin isolated is a key defence.