XML Injection Vulnerability in ColdFusion by Adobe

CVE-2025-49538

What is CVE-2025-49538?

ColdFusion versions 2025.2, 2023.14, 2021.20, and earlier are susceptible to an XML Injection vulnerability that enables unauthorized access to the file system. This can occur through crafted XML or XPath queries, allowing an attacker to read sensitive files or potentially launch a denial of service. Exploitation of this vulnerability does not necessitate user interaction; however, it does require that the attacker has access to shared secrets.

References