PT-2026-57864 · Adobe · Coldfusion

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-48363

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier

Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the application fails to properly sanitize the paths used to search for files or dependencies. Exploitation requires user interaction, specifically requiring a victim to open a malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-48363

Affected Products

Coldfusion

References · 4

• https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48363 · Security Note
• https://twitter.com/infoflowcloud/status/2076770177354453183 · Twitter Post
• https://twitter.com/CVEnew/status/2076767956512727474 · Twitter Post