Path Traversal Flaw in ColdFusion's Remote Development Services by Adobe

CVE-2026-90530

What is CVE-2026-90530?

The ColdFusion Remote Development Services (RDS) feature is susceptible to a path traversal vulnerability that allows attackers to read arbitrary files from the file system. This issue arises from inadequate constraints on pathname access, enabling unauthorized users to access sensitive files and directories beyond the allocated scope. Notably, exploitation does not require user interaction, contrasting with many other vulnerabilities. To mitigate this risk, it's crucial for users to disable RDS when not in use, particularly in production environments, as recommended in the Lockdown Guide.

References