Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation requires user interaction and changes the scope.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2025-61823 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and require user interaction. The attacker can craft a malicious XML input that includes an external entity reference, which can lead to the disclosure of sensitive files on the server. This exploitation can occur over the network, making it accessible to remote attackers.
Affected Products
- ColdFusion 2025.4: Affected by XXE vulnerability allowing file system access.
- ColdFusion 2023.16: Vulnerable to arbitrary file read due to improper XML handling.
- ColdFusion 2021.22: Exposed to risks from high privileged attackers exploiting XML external entities.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of ColdFusion that addresses the XXE issue. Additionally, it is recommended to implement strict input validation and avoid processing untrusted XML data. Regular security audits and monitoring can also help in identifying and mitigating potential exploitation attempts.