CVE-2023-26361

Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability

State: Published
Severity: 4.9 Medium
Published: Mar 23, 2023
Updated: Mar 5, 2025
Reserved: Feb 22, 2023

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	adobe

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Affected Products

Product	Versions
ColdFusionAdobe	CF2018U15, CF2021U5 and earlierAffected None and earlierAffected

References

https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.