Path Traversal Vulnerability in Adobe ColdFusion
CVE-2026-47932

8.8HIGH

Key Information:

Vendor

Adobe
Status
Coldfusion
Vendor
CVE Published:
9 June 2026

What is CVE-2026-47932?

Adobe ColdFusion versions 2023.19, 2025.8 and earlier are susceptible to an improper limitation of a pathname to a restricted directory, allowing for potential security feature bypass. This vulnerability may permit attackers to access unauthorized files and directories beyond the defined access limitations. Exploitation requires user interaction, as victims must open a specially crafted malicious file. This raises significant concerns regarding the integrity and confidentiality of the data handled by the affected ColdFusion instances.

Affected Version(s)

ColdFusion 0 <= 2025.8

References

https://helpx.adobe.com/security/products/coldfusion/apsb...
vendor-advisory

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.