PT-2025-50289 · Adobe · Coldfusion

Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-61823

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.4, 2023.16, and 2021.22 and earlier

Description An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists in ColdFusion, potentially allowing an attacker to read arbitrary files from the system. A high-privileged attacker could exploit this to access sensitive files and data on the server. Exploitation requires user interaction.

Recommendations Update ColdFusion to a version later than 2021.22.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-15475

CVE-2025-61823

Affected Products

Coldfusion

References · 7

• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61823 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15475 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61823 · Security Note
• https://t.me/CVEtracker/39318 · Telegram Post
• https://twitter.com/CVEnew/status/1998732771272057047 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998671809600704859 · Twitter Post