PT-2025-50284 · Adobe · Coldfusion

Published 2025-12-09 · Updated 2025-12-16 · CVE-2025-61811

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier

Description An improper access control issue exists in ColdFusion that could allow for arbitrary code execution with the privileges of the current user. An attacker with high privileges could bypass security measures and execute malicious code. Exploitation of this issue does not require user interaction. The scope of the issue is changed.

Recommendations Update ColdFusion to a version later than 2021.22. Update ColdFusion to a version later than 2023.16. Update ColdFusion to a version later than 2025.4.

Fix

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

BDU:2025-15516

CVE-2025-61811

Affected Products

Coldfusion

References · 9

• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61811 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61811 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1998687169167200628 · Twitter Post
• https://twitter.com/cracbot/status/2000521263585071480 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000957965394657298 · Twitter Post
• https://t.me/CVEtracker/39313 · Telegram Post
• https://twitter.com/CVEnew/status/1998732772358434906 · Twitter Post