PT-2025-27666 · Lucee · Lucee

Alexander Philiotis

·

Published

2025-07-02

·

Updated

2026-03-23

·

CVE-2025-34074

CVSS v4.0

9.4

Critical

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions: Lucee versions 5.x through 6.x
Description: An authenticated remote code execution issue exists in Lucee's administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution.
Recommendations: For Lucee versions 5.x through 6.x, restrict access to the scheduled task functionality and monitor configurations to minimize the risk of exploitation. As a temporary workaround, consider disabling the scheduled task feature until a patch is available. Avoid using the scheduled task functionality to retrieve remote files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94CWE-829

Related Identifiers

CVE-2025-34074

Affected Products

Lucee