CVE-2022-38424: Adobe ColdFusion path traversal allows arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires administrator privileges and no active exploitation is documented.

What it is

Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier, contain a path traversal flaw (CWE-22) that lets a pathname escape its restricted directory. Successful abuse results in arbitrary file system write, which matters because written files can alter server behavior or plant code. The record gives no further detail on the exact vulnerable endpoint.

Impact

An attacker with administrator privileges gains the ability to write arbitrary files on the server's file system. That can lead to code execution or full server compromise depending on what files can be overwritten.

Attack surface

The CVSS vector is network-reachable (AV:N) with low attack complexity and no user interaction (UI:N), but it requires high privileges (PR:H), meaning an authenticated administrator account is needed. No other reachability detail is provided in the record.

Exploitation

CISA KEV does not list this CVE and no ransomware use is documented. EPSS is high at roughly 0.45 probability (98.7th percentile), but the only references are vendor advisories, so there is no public evidence of active exploitation in this record.

What to do

• Apply the Adobe ColdFusion security update referenced in advisory APSB22-44, upgrading past Update 14 and Update 4.
• Restrict and audit administrator accounts on ColdFusion servers; the flaw requires admin privileges, so limiting who holds them reduces exposure.
• Run ColdFusion with least-privilege file system permissions so a traversal write cannot reach sensitive directories.
• Place ColdFusion admin interfaces behind network controls and do not expose them to untrusted networks.
• Monitor file system changes in ColdFusion web and configuration directories for unexpected writes.

Detection

• Alert on new or modified files in ColdFusion web roots and config directories outside normal deployment windows.
• Monitor ColdFusion admin activity and requests containing path traversal sequences such as ../ in file-related parameters.
• Correlate administrator logins with subsequent file creation or modification events on the ColdFusion host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.