CVE-2023-26361

Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability

At a glance

Severity: MEDIUM 4.9
EPSS: EPSS 58.66 % · percentile 99 (2026-10-27)
State: PUBLISHED
Published: 2023-03-23
Updated: 2025-03-05
Assigner: adobe
NVD status: Modified

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	adobe
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	NVD · psirt@adobe.com (Secondary)

Weaknesses (CWE)

CWE-22

European references

ENISA EUVD · EUVD-2023-30182
GCVE · GCVE-0-2023-26361

CERT-FR advisories

CERTFR-2023-AVI-0227 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*

Affected products

Product	Versions
Adobe · ColdFusion	affected unspecified ≤ CF2018U15, CF2021U5 ; affected unspecified ≤ None

References

https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD