Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the server. Exploitation does not require user interaction and the scope is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.2 | CVE-2025-61813 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted XML request to the ColdFusion server. This request can manipulate the XML External Entity Reference, allowing the attacker to read sensitive files from the server’s file system. Since the exploitation does not require user interaction, it can be executed remotely, making it a significant risk.
Affected Products
- ColdFusion 2025.4 – Affected by XXE vulnerability allowing file system access.
- ColdFusion 2023.16 – Vulnerable to arbitrary file reads through XML manipulation.
- ColdFusion 2021.22 – Exposed to risks from improper XML external entity handling.
Mitigation
To mitigate this vulnerability, it is recommended to update ColdFusion to the latest version that addresses the XXE vulnerability. Additionally, implementing proper input validation and restricting XML processing can help reduce the risk of exploitation.