Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high privileged attacker. Exploitation of this issue does not require user interaction and the scope is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-61808 |
Exploitation
An attacker can exploit this vulnerability by uploading a malicious file to the server without any restrictions. Since the attack does not require user interaction, it can be executed remotely, allowing the attacker to gain high-level privileges and execute arbitrary code on the affected system.
Affected Products
- ColdFusion 2025.4 – Affected by the vulnerability allowing unrestricted file uploads.
- ColdFusion 2023.16 – Vulnerable to arbitrary code execution due to file upload issues.
- ColdFusion 2021.22 – Exposed to risks from unrestricted file uploads.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of ColdFusion that addresses the issue. Additionally, implementing strict file upload validation and monitoring server logs for suspicious activity can help reduce the risk of exploitation.