7.7 HighCWE-22
CVE-2026-34619
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
AdobeColdFusion 2025
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
1.1%probability of exploitation in the next 30 days
Higher than 66% of scored CVEs
SeverityCVSS
7.7High
Description NVD
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Coverage 1 article · 1 outlet
- Exploiters target SAP SQLi and Adobe zero day flaws in AprilThe Hacker News · first in our coverage · mentions it in passing