CVE-2025-61808

Critical

Published: 10/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high privileged attacker. Exploitation of this issue does not require user interaction and scope is changed.

Risk Assessment

A high-privileged attacker can upload a malicious file and execute code, potentially leading to full system compromise.

Recommendation

Immediately update ColdFusion to the latest version and implement restrictions on uploaded file types.

Original NVD description (English source)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.