CVE-2026-48315

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier

Description Improper Input Validation allows for arbitrary code execution within the context of the current user. An attacker can inject malicious scripts into a web page to potentially gain elevated access or control over a victim's account or session. This issue requires user interaction, specifically that a victim opens a malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.