Improper Restriction of XML External Entity Reference in Adobe ColdFusion
CVE-2025-49544
6.8MEDIUM
What is CVE-2025-49544?
Adobe ColdFusion versions 2025.2, 2023.14, 2021.20, and earlier are vulnerable to a significant security issue characterized by improper restriction of XML External Entity (XXE) reference. An attacker with high privileges can exploit this flaw to gain unauthorized access to sensitive data and evade established security measures. Notably, the exploitation can occur without any user interaction, altering the scope of potential impacts on affected systems.
Affected Version(s)
ColdFusion 0 <= 2021.20