Product:
ColdFusion
Summary
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2026-34619 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to the ColdFusion server, allowing them to traverse the file system and access files or directories that should be restricted. Since the attack does not require user interaction, it can be executed remotely, making it a significant risk for affected systems.
Affected Products
- ColdFusion 2023.18: Affected by path traversal vulnerability allowing unauthorized file access.
- ColdFusion 2025.6: Vulnerable to security feature bypass through improper pathname limitations.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses this issue. Additionally, implementing strict access controls and monitoring file access can help reduce the risk of exploitation.