PT-2025-50281 · Adobe · Coldfusion

Published 2025-12-09 · Updated 2026-02-06 · CVE-2025-61808

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier

Description ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier are susceptible to an unrestricted file upload issue with dangerous file types. Successful exploitation of this issue could allow a high-privileged attacker to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.

Recommendations Update ColdFusion to a version later than 2021.22.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-15514

CVE-2025-61808

ZDI-26-070

Affected Products

Coldfusion

References · 12

• https://bdu.fstec.ru/vul/2025-15514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61808 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61808 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-070 · Security Note
• https://twitter.com/cracbot/status/2000521258379964824 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998689729122803913 · Twitter Post
• https://twitter.com/hoyahaxa/status/2008301941353574589 · Twitter Post
• https://twitter.com/0dayPublishing/status/1998621322482491631 · Twitter Post
• https://twitter.com/CVEnew/status/1998732761608368359 · Twitter Post
• https://twitter.com/transilienceai/status/2002257844351971787 · Twitter Post
• https://t.me/CVEtracker/39310 · Telegram Post