CVE-2026-48282

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 2025 Update 10 Adobe ColdFusion versions prior to 2023 Update 21

Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthenticated remote attacker to read and write arbitrary files. This occurs because the RDS FILEIO handler passes user-supplied paths directly to the file system without canonicalization, enabling the use of traversal sequences like .. or absolute paths to escape the RDS root. An attacker can exploit this by sending a single HTTP POST request to the endpoint '/CFIDE/main/ide.cfm' using the ACTION parameter set to 'FILEIO'. This can lead to arbitrary code execution in the context of the current user, often running as SYSTEM on Windows, by writing a CFML webshell to the web root. This issue has been actively exploited in the wild, with approximately 800 servers reported as accessible on the internet.

Recommendations Update Adobe ColdFusion 2025 to Update 10. Update Adobe ColdFusion 2023 to Update 21. Rotate CF admin, database, and service account credentials if anomalous file writes are detected.