XML External Entity Reference Vulnerability in ColdFusion by Adobe

CVE-2025-61813

What is CVE-2025-61813?

ColdFusion versions 2025.4, 2023.16, and 2021.22, along with earlier versions, suffer from an Improper Restriction of XML External Entity Reference vulnerability. This flaw allows attackers to exploit the system and gain unauthorized access to sensitive files located on the server. The exploitation process does not necessitate user interaction, indicating a significant risk to server data security. For detailed information and guidance on mitigation, refer to the official Adobe security advisory.

References