Critical severity10.0NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026
CVE-2025-54261
CVE-2025-54261
Description
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.
Affected products
44cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*+ 43 more
- cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update19:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update20:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update21:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*
- (no CPE)range: <=2025.3, <=2023.15, <=2021.21
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
1- helpx.adobe.com/security/products/coldfusion/apsb25-93.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.