CVE-2025-43566: Adobe ColdFusion path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (6.8) and exploitation requires high privileges, but the high EPSS percentile and scope change warrant prompt patching.

What it is

Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier contain a path traversal flaw (CWE-22) that permits reading files outside the intended restricted directory. Because the vulnerable component is network reachable and scope is changed, a successful read can expose sensitive files beyond the application's own boundary.

Impact

An attacker with high privileges gains unauthorized read access to arbitrary files on the host, potentially exposing configuration, credential or other sensitive data. Integrity and availability are not affected per the CVSS vector.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but the vector requires high privileges (PR:H), so the attacker must already hold an administrative or similarly elevated ColdFusion account.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record; EPSS is high at 0.551 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Adobe ColdFusion update referenced in advisory APSB25-52 for the affected 2025.1, 2023.13 and 2021.19 branches.
• Restrict and audit administrative ColdFusion accounts, since exploitation requires high privileges.
• Limit network exposure of ColdFusion administrative interfaces to trusted management networks.
• Review file system permissions for the ColdFusion service account to reduce the impact of arbitrary file reads.

Detection

• Monitor ColdFusion logs and web access logs for path traversal sequences (../, encoded variants) in requests to administrative or file-serving endpoints.
• Alert on unexpected reads of sensitive files (configuration, credential stores) by the ColdFusion service account.
• Track authentication and privilege changes on ColdFusion administrative accounts for signs of abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.