Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation does not require user interaction and the scope is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-61821 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted XML request to the ColdFusion server. This request can manipulate the XML External Entity processing to read sensitive files from the server’s file system. Since the attack does not require user interaction, it can be executed remotely, making it a significant risk for affected systems.
Affected Products
- ColdFusion 2025.4 – Affected by XXE vulnerability allowing file system access.
- ColdFusion 2023.16 – Vulnerable to arbitrary file reads through XML processing.
- ColdFusion 2021.22 – Exposed to risks from improper XML entity handling.
Mitigation
To mitigate this vulnerability, it is recommended to update ColdFusion to the latest version that addresses the XXE issue. Additionally, disabling XML External Entity processing in the application configuration can help prevent exploitation. Regular security audits and monitoring for unusual file access patterns can also enhance security.