XML Injection Vulnerability in ColdFusion by Adobe
CVE-2025-49538

7.4HIGH

Key Information:

Vendor

Adobe
Status
Coldfusion
Vendor
CVE Published:
8 July 2025

What is CVE-2025-49538?

ColdFusion versions 2025.2, 2023.14, 2021.20, and earlier are susceptible to an XML Injection vulnerability that enables unauthorized access to the file system. This can occur through crafted XML or XPath queries, allowing an attacker to read sensitive files or potentially launch a denial of service. Exploitation of this vulnerability does not necessitate user interaction; however, it does require that the attacker has access to shared secrets.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ColdFusion 0 <= 2021.20

References

https://helpx.adobe.com/security/products/coldfusion/apsb...
vendor-advisory

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.