Improper Restriction of XML External Entity Reference in Adobe ColdFusion
CVE-2025-49544

6.8MEDIUM

Key Information:

Vendor

Adobe
Status
Coldfusion
Vendor
CVE Published:
8 July 2025

What is CVE-2025-49544?

Adobe ColdFusion versions 2025.2, 2023.14, 2021.20, and earlier are vulnerable to a significant security issue characterized by improper restriction of XML External Entity (XXE) reference. An attacker with high privileges can exploit this flaw to gain unauthorized access to sensitive data and evade established security measures. Notably, the exploitation can occur without any user interaction, altering the scope of potential impacts on affected systems.

Affected Version(s)

ColdFusion 0 <= 2021.20

References

https://helpx.adobe.com/security/products/coldfusion/apsb...
vendor-advisory

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-49544 : Improper Restriction of XML External Entity Reference in Adobe ColdFusion