Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-61809 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the affected ColdFusion server. By manipulating input parameters, the attacker can bypass security controls, allowing unauthorized access to sensitive data and the ability to modify or delete files without needing any user interaction.
Affected Products
- ColdFusion 2025.4: Affected by improper input validation leading to security feature bypass.
- ColdFusion 2023.16: Vulnerable to unauthorized read and write access due to input validation issues.
- ColdFusion 2021.22: Similar vulnerabilities present as in other versions, allowing exploitation without user interaction.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the improper input validation issue. Additionally, implementing strict input validation and monitoring server logs for unusual activity can help reduce the risk of exploitation.