CVE-2026-47932
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a Path Traversal vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation requires user interaction and the scope is changed.
Risk Assessment
The risk includes the possibility of remote code execution in the user context, which could lead to system compromise or data theft.
Recommendation
It is recommended to immediately update ColdFusion to a patched version and restrict access to the administrative network zone.
Original NVD description (English source)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.