CVE-2023-26361: Adobe ColdFusion path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw is a high-impact file read but requires administrator privileges, and CVSS rates it 4.9 medium despite a high EPSS score.

What it is

Adobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier contain a path traversal flaw (CWE-22) that lets a pathname escape its restricted directory. It matters because it enables arbitrary file system reads on the server, and the affected versions are broad enough that unpatched ColdFusion instances remain exposed.

Impact

An attacker with administrator privileges can read arbitrary files on the server file system, exposing configuration, credential and application data. There is no write or code execution impact described in the record.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but it requires high privileges (PR:H), meaning an attacker must already hold a ColdFusion administrator account or equivalent access.

Exploitation

Not listed in CISA KEV and no ransomware use is documented; EPSS is high at roughly 0.587 (99th percentile), and the only references are Adobe's patch advisory, so no public exploit code is confirmed by this record.

What to do

• Apply the Adobe ColdFusion update referenced in advisory APSB23-25 to move past 2018 Update 15 and 2021 Update 5.
• Restrict and audit ColdFusion administrator accounts, enforcing least privilege and removing unused admin access.
• Limit network exposure of ColdFusion admin interfaces to trusted management networks.
• Monitor and rotate any credentials or secrets stored in files readable by the ColdFusion service account.

Detection

• Review ColdFusion server logs for path traversal patterns such as ../ sequences in file or template parameters.
• Alert on unexpected file read activity by the ColdFusion service account outside web roots and application directories.
• Audit administrator logins and actions for anomalous or off-hours access to file-handling features.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.