CVE-2026-48313: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Synopsis

A path traversal vulnerability in Adobe ColdFusion versions 2025.9, 2023.20, and earlier allows an unauthenticated remote attacker to read arbitrary files and perform limited writes on the host file system. The flaw is reachable directly over the network with no credentials or victim interaction required, and the changed scope means impact can extend beyond the ColdFusion process itself to other components on the same host. Successful exploitation gives an attacker access to sensitive files outside the web root and limited ability to modify file system content. HarborGuard is tracking the advisory for patch availability, as no fix version has been published by Adobe.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ColdFusion service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials of any privilege level are required to trigger the path traversal.

• Victim interactionNot required

  Exploitation is fully server-side and does not depend on any action by a user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or knowledge of memory layout.

Blast Radius

• An attacker reads arbitrary files on the ColdFusion host, including configuration files, credential stores, private keys, and application source code outside the web root.
• The changed scope means sensitive files belonging to the operating system or co-located services, not just ColdFusion itself, are within reach.
• Limited file system write access allows an attacker to plant or modify files, which can serve as a stepping stone toward persistence or code execution depending on file permissions.
• Exposure of credentials or session material found in configuration files enables follow-on attacks against connected databases, directories, or internal services.