PT-2025-28745 · Adobe · Coldfusion

Published 2025-07-08 · Updated 2025-07-09 · CVE-2025-49538

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier

Description: The issue is related to an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this problem by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and the attack must have access to shared secrets.

Recommendations: For versions 2025.2, 2023.14, and 2021.20, update to a version that contains a fix for this issue. For versions prior to 2021.20, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-91

Related Identifiers

BDU:2025-08387

CVE-2025-49538

Affected Products

Coldfusion

References · 5

• https://bdu.fstec.ru/vul/2025-08387 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49538 · Security Note
• https://twitter.com/CVEnew/status/1942958415858303279 · Twitter Post