CVE-2026-47932: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Synopsis

A path traversal vulnerability in Adobe ColdFusion (versions 2025.8 and earlier, including 2023.19 and earlier) allows an attacker on the same network segment to bypass directory restrictions and access files or directories outside the intended scope. Exploitation requires a victim to open a malicious file, and a successful attack gives the attacker read, write, and denial-of-service capability across affected resources with scope change into dependent components. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (LAN, VPN, or equivalent broadcast domain) to reach the vulnerable ColdFusion service; remote internet-based exploitation without network adjacency is not possible.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to stage the attack against the affected ColdFusion instance.

• Victim interactionRequired

  A victim must open a malicious file delivered by the attacker, meaning a social-engineering step is required to complete exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads arbitrary files and directories on the ColdFusion host that fall outside the intended restricted path, including configuration files, credentials, and application source code.
• Writes or overwrites files outside the restricted directory, enabling persistent modification of application logic or server configuration.
• Crashes or disrupts the ColdFusion service through destructive file manipulation, causing service outages for dependent applications.
• Because scope is changed, impact extends beyond the ColdFusion process itself into dependent components or containers sharing the filesystem or runtime environment.