Product:
ColdFusion
Summary
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory vulnerability that could lead to arbitrary code execution by an attacker. The vulnerability allows attackers to manipulate file paths and potentially execute malicious code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9 | CVE-2025-54261 |
Exploitation
To exploit this vulnerability, an attacker can craft a request that includes a specially formatted pathname, allowing them to traverse directories and access restricted files. By doing so, they can execute arbitrary code on the server, leading to a complete compromise of the affected system.
Affected Products
- ColdFusion 2025.3 – Affected by path traversal vulnerability allowing arbitrary code execution.
- ColdFusion 2023.15 – Vulnerable to directory traversal leading to potential code execution.
- ColdFusion 2021.21 – Subject to exploitation through improper pathname limitations.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the path traversal issue. Additionally, implementing strict input validation and sanitization can help prevent exploitation of this vulnerability.