Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary code execution. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-61812 |
Exploitation
An attacker with high privileges can exploit this vulnerability by sending specially crafted input to the affected ColdFusion application. Since the attack does not require user interaction, it can be executed remotely, making it easier for attackers to gain control over the system and execute arbitrary code.
Affected Products
- ColdFusion 2025.4 – Affected by improper input validation leading to potential code execution.
- ColdFusion 2023.16 – Vulnerable to exploitation without user interaction.
- ColdFusion 2021.22 – High privilege requirement for exploitation.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the improper input validation issue. Regularly applying security patches and following best practices for input validation can also help reduce the risk of exploitation.