CVE-2026-48283: ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

Synopsis

An unrestricted file upload vulnerability in Adobe ColdFusion (versions 2023.20 and earlier, and 2025.9 and earlier) allows a remote, unauthenticated attacker to upload arbitrary file types directly to the server. Because no authentication or user interaction is required and the vulnerability carries a changed scope, a successful exploit gives the attacker arbitrary code execution in the context of the running ColdFusion process, with full confidentiality, integrity, and availability impact. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exposed over the network; an attacker must be able to reach the ColdFusion service via HTTP or HTTPS to deliver a malicious file upload request.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the upload endpoint is reachable without authentication.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout dependencies.

Blast Radius

• Attacker uploads and executes a server-side web shell, gaining arbitrary command execution in the context of the ColdFusion process account.
• All data accessible to the ColdFusion process, including database credentials, session tokens, and application secrets stored on the host, is readable by the attacker.
• The attacker can modify or delete application files, database records, and configuration data reachable by the ColdFusion process.
• The running ColdFusion service and any co-located services sharing the same process context can be crashed or rendered unavailable.