CVE-2026-48282: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Synopsis

A path traversal vulnerability in Adobe ColdFusion (versions 2025.9, 2023.20, and earlier) allows a remote, unauthenticated attacker to read and write files outside the server's intended directory boundaries. Because scope is changed, successful exploitation can break out of the application context and achieve arbitrary code execution on the underlying host. No fix versions have been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ColdFusion service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are required to trigger the vulnerability.

• Victim interactionNot required

  The attacker can exploit this vulnerability without any action from a user or administrator on the target system.

• Attack complexityDetail

  The exploit is reliable and imposes no special preconditions, race conditions, or environmental requirements on the attacker.

Blast Radius

• An attacker reads arbitrary files on the server, including configuration files, credentials, and application secrets stored outside the web root.
• An attacker writes or overwrites arbitrary files, enabling placement of a web shell or modification of application code.
• With scope changed, the attacker achieves arbitrary code execution in the context of the ColdFusion process user, which can extend compromise to the underlying operating system.
• Full confidentiality, integrity, and availability of the host and any co-located services are at risk once code execution is established.