Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation requires user interaction and changes the scope.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-61810 |
Exploitation
To exploit this vulnerability, an attacker must craft malicious serialized data and deliver it to the ColdFusion application. This requires the attacker to have high privileges and the user must interact with the application to trigger the execution of the malicious data. Once executed, the attacker can gain control over the application in the context of the current user.
Affected Products
- ColdFusion 2025.4 – Affected by the deserialization vulnerability.
- ColdFusion 2023.16 – Affected by the deserialization vulnerability.
- ColdFusion 2021.22 – Affected by the deserialization vulnerability.
- Earlier versions – All versions prior to the specified ones are also affected.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the deserialization issue. Additionally, implementing strict input validation and avoiding the use of untrusted data for deserialization can help reduce the risk of exploitation.