ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
References
| Link | Resource |
|---|---|
| https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Apr 2026, 14:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:* |
|
| First Time |
Adobe
Adobe coldfusion |
|
| References | () https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html - Vendor Advisory |
14 Apr 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-14 22:16
Updated : 2026-04-16 14:42
NVD link : CVE-2026-27305
Mitre link : CVE-2026-27305
CVE.ORG link : CVE-2026-27305
JSON object : View
Products Affected
adobe
- coldfusion
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')