CVE-2026-48313: Adobe ColdFusion 2025 vulnerability
Adobe · ColdFusion 2025
Vendor fix available · Affected: Adobe ColdFusion 2025 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 87% of scored CVEs
DescriptionNVD
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- ColdFusion - Path Traversal · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- Adobe
- Published
- June 2026
Coverage1 article · 1 outlet
First in our coverage: Security Affairs, 2 Jul.
- Adobe Fixes ColdFusion, Campaign Classic Bugs Rated CVSS 10.0Security Affairs · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.