ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
En bref
Sévérité
CRITICAL 10.0
Exploitation
Exploitation connue (CISA KEV) · ajoutée le 2026-07-07 Exploitée selon l'ENISA depuis le 2026-07-07
EPSS
EPSS 42.39 % · centile 99 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
adobe
Statut NVD
Analyzed
Description
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
