CVE-2026-48276: ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

Synopsis

An unrestricted file upload vulnerability in Adobe ColdFusion (versions 2023.20 and earlier, and 2025.9 and earlier) allows a remote, unauthenticated attacker to upload arbitrary files, including executable scripts, directly to the server. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) confirms the service is reachable over the network with no authentication or victim interaction required, and the changed scope means a successful exploit can break out of the application context into the broader host environment. Successful exploitation gives the attacker full remote code execution, plus complete read, write, and availability control over the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ColdFusion endpoint is exposed over the network; an attacker must be able to reach it via HTTP/HTTPS from any internet or internal network position.

• AuthenticationNot required

  No account, session token, or credential of any kind is needed; the upload endpoint accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental preconditions.

Blast Radius

• The attacker uploads and executes arbitrary server-side code, achieving full remote code execution in the ColdFusion process context.
• All data readable by the ColdFusion process is exposed, including database credentials, session tokens, configuration files, and application data.
• The attacker can write, overwrite, or delete any file accessible to the ColdFusion process, including application code and operating-system files.
• Because scope is changed, the attacker can pivot beyond the ColdFusion application boundary to affect other services and resources on the host or adjacent systems.