Unrated severityNVD Advisory· Published Sep 9, 2025· Updated Oct 8, 2025
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVE-2025-54261
Description
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.
Affected products
2<= 2025.3, <= 2023.15, <= 2021.21+ 1 more
- (no CPE)range: <= 2025.3, <= 2023.15, <= 2021.21
- (no CPE)range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- helpx.adobe.com/security/products/coldfusion/apsb25-93.htmlmitrevendor-advisory
News mentions
0No linked articles in our index yet.