ColdFusion Path Traversal

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the directory structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ColdFusion Path Traversal Unauthorized Access

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the directory structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ColdFusion Privilege Escalation

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

ColdFusion Auth Bypass Privilege Escalation

The vulnerability of the ColdFusion software platform is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2026-48332

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

CVE-2026-48338

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-48320

CVE-2026-48320: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue enables injection of malicious scripts into a web page and is described as having a HIGH impact with confidentiality and integrity at risk, though availability is not affected. The vulnerable...

CVE-2026-48318 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-48329 ColdFusion | Insufficient Session Expiration (CWE-613)

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

CVE-2026-48321

Technical details are not publicly available in the provided documents; no affected products, versions, or remediation are specified. Monitor for updates.

ColdFusion Unrestricted File Execution

The vulnerability of the ColdFusion software platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-48313

creationtimestamp| type| source ---|---|--- 2026-07-01 09:45:16+00:00| seen| https://www.cert.dk/news/2026-07-01/Kritiske-ColdFusion-saarbarheder-aabner-for-fuld-serverovertagelse 2026-07-01 13:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpll4ubpnt2q 2026-07-02...

CVE-2026-48281

creationtimestamp| type| source ---|---|--- 2026-07-01 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpkjycun2h2g 2026-07-01 09:45:09+00:00| seen| https://www.cert.dk/news/2026-07-01/Kritiske-ColdFusion-saarbarheder-aabner-for-fuld-serverovertagelse 2026-07-01 13:00:13+00:00|...

CVE-2026-48276

creationtimestamp| type| source ---|---|--- 2026-07-01 02:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpkgmzkfc726 2026-07-01 09:45:03+00:00| seen| https://www.cert.dk/news/2026-07-01/Kritiske-ColdFusion-saarbarheder-aabner-for-fuld-serverovertagelse 2026-07-01 12:00:35+00:00|...

PT-2026-53905

Name of the Vulnerable Software and Affected Versions ColdFusion versions prior to 2025.10 Description A Server-Side Request Forgery SSRF issue allows an attacker to bypass security features and obtain unauthorized read access. This flaw can be exploited without any user interaction...

ColdFusion Auth Bypass Privilege Escalation

The vulnerability of the ColdFusion interpreter is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

ColdFusion XML External Object Access Disclosure

The vulnerability of the ColdFusion interpreter is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ColdFusion Interpreter Security Bypass

The vulnerability of the ColdFusion interpreter is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

CVE-2026-47929

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim...