ColdFusion Path Traversal Exposes Arbitrary File Reads

The National Vulnerability Database (NVD) recently detailed a critical path traversal vulnerability, CVE-2026-27305, affecting several versions of Adobe ColdFusion. Specifically, ColdFusion versions 2023.18, 2025.6, and earlier releases are susceptible to this flaw. This isn’t just a run-of-the-mill bug; it’s a severe ‘Improper Limitation of a Pathname to a Restricted Directory’ issue, commonly known as path traversal (CWE-22).

Exploitation of this vulnerability allows an attacker to perform arbitrary file system reads. Think about that for a second: unrestricted access to files and directories outside the intended scope. We’re talking sensitive configuration files, proprietary data, or even credentials just sitting there, ripe for the picking. The really nasty part? According to the NVD, this doesn’t even require user interaction, making it particularly dangerous for internet-facing ColdFusion deployments. With a CVSS score of 8.6 (HIGH), this is a red alert for anyone running these platforms.