Executive brief
Adobe ColdFusion, a platform for building web applications, is vulnerable to a security flaw that allows attackers to read sensitive files from the server's file system. By tricking a user into interacting with a malicious request, an attacker could gain access to confidential configuration files or system data. This could lead to further compromise of the server or the exposure of private customer information.
Technical details
This vulnerability is an XML External Entity (XXE) injection (CWE-611) within Adobe ColdFusion. It occurs due to improper restriction of XML external entity references during the processing of XML data. A remote, unauthenticated attacker can exploit this by sending a specially crafted XML payload, though the attack requires some form of user interaction. Successful exploitation allows the attacker to read arbitrary files from the server's file system and potentially impact the availability of the service. Adobe has released security updates to address this issue in APSB25-105.
Affected products
- Adobe ColdFusion 2025.4 and earlier, 2023.16 and earlier, 2021.22 and earlier
Timeline
- 2025-12-09: disclosed
- 2025-12-10: advisory