Adobe ColdFusion - RDS Arbitrary File Write
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed. References: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/ Remediation: Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.
Used 20 times · 10 assets checked · domain, subdomain, ipv4