CVE-2026-48318
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction and the scope is changed.
Risk Assessment
The risk involves potential read access to sensitive data such as configuration files, passwords, or user data, which could lead to confidentiality breaches and attack escalation. The lack of required user interaction increases the risk of automated exploitation.
Recommendation
Apply the security update provided by the vendor for ColdFusion immediately. Additionally, restrict server access and monitor logs for suspicious path traversal requests.
Original NVD description (English source)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.