PT-2025-36859 · Adobe · Coldfusion

Published 2025-09-09 · Updated 2025-10-08 · CVE-2025-54261

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier

Description: ColdFusion versions 2025.3, 2023.15, and 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') issue. This could allow an attacker to execute arbitrary code.

Recommendations: Update ColdFusion to a version later than 2021.21.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-11694

CVE-2025-54261

Affected Products

Coldfusion

References · 14

• https://helpx.adobe.com/security/products/coldfusion/apsb25-93.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54261 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54261 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11694 · Security Note
• https://twitter.com/TweetThreatNews/status/1965579171033199043 · Twitter Post
• https://t.me/cveNotify/137302 · Telegram Post
• https://twitter.com/0dayPublishing/status/1973506663345696945 · Twitter Post
• https://twitter.com/TeraTechCF/status/1975841373027783166 · Twitter Post
• https://t.me/cveNotify/137127 · Telegram Post
• https://twitter.com/Fusion_Reactor/status/1975210757227761895 · Twitter Post
• https://twitter.com/CCBalert/status/1965792164589289962 · Twitter Post
• https://twitter.com/CVEnew/status/1965557765557858608 · Twitter Post
• https://twitter.com/nakultomar___/status/1969614112477904901 · Twitter Post
• https://t.me/cveNotify/135331 · Telegram Post