Unrated

Path Traversal Arbitrary File Read in Adobe ColdFusion

IdentifiersCVE-2026-48313CWE-22

CVE-2026-48313 is a path traversal vulnerability in Adobe ColdFusion caused by improper limitation of a pathname to a restricted directory. It affects ColdFusion 2025.9, 2023.20, and earlier versions. A remote attacker can exploit the flaw to access files and directories outside the intended access scope, resulting in arbitrary file system read and limited write access. The issue does not require user interaction and is described as remotely exploitable.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can expose sensitive files and directories outside the intended restricted path, including configuration data and potentially credentials or other secrets stored on the server. The vulnerability also allows limited file write access, which increases integrity risk beyond disclosure alone. The provided context states the CVSS 3.1 base score is 9.3 with scope changed, and notes high confidentiality, integrity, and availability impact.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict ColdFusion access to sensitive files and directories as much as operationally feasible, monitor for unauthorized file system access attempts, and apply Adobe’s ColdFusion hardening guidance. The provided advisory context also recommends using the latest supported JDK/JRE LTS release, the latest MySQL Java connector, applying ColdFusion security configuration and Lockdown Guide recommendations, and for JEE deployments configuring the documented JVM serial filter option.

Remediation

Patch, then assume compromise.

Upgrade Adobe ColdFusion 2025 to Update 10 and Adobe ColdFusion 2023 to Update 21. More generally, update to a version newer than 2025.9 and 2023.20, as those versions and earlier are affected. Adobe strongly recommends applying the vendor security update as soon as possible.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AdobeColdfusionapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

security affairsNews

Jul 2, 2026

Adobe fixed multiple maximum-severity flaws in ColdFusion and Campaign Classic - Security Affairs

A critical Adobe ColdFusion path traversal vulnerability that could allow attackers to read sensitive files.

the hacker newsNews

Jul 1, 2026

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary file system read.

socradar blogNews

Jul 1, 2026

Adobe ColdFusion and Campaign Classic: Critical RCE Flaws Among Multiple CVSS 10.0 Issues

A high-severity Adobe ColdFusion arbitrary file read vulnerability with CVSS 9.3.

cyber security newsNews

Jul 1, 2026

Critical Multiple Adobe ColdFusion Vulnerabilities Enables Arbitrary Code Execution Attacks

A critical path traversal vulnerability in Adobe ColdFusion that allows arbitrary file system reads and may expose configuration data and credentials.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48313

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48313

MITRE CWE · CWE-22

cwe.mitre.org