Executive brief
Lucee CFML Server, a popular open-source platform for building web applications, contains a security flaw in how it handles web addresses. An attacker can send a specially crafted link to a user; if clicked, the attacker can run malicious code in the user's browser. This could allow the attacker to steal login sessions or perform unauthorized actions within the Lucee administrative interface.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Lucee CFML Server due to improper neutralization of input during URL path parsing. The root cause is the server reflecting request path components into the response without adequate output encoding. An unauthenticated remote attacker can exploit this by crafting a URL containing HTML or JavaScript payloads (e.g., within the path before index.cfm). When a victim visits the link, the payload executes in their browser context, potentially leading to session hijacking or unauthorized administrative actions. The vulnerability affects multiple release lines from version 5.3.1.95 up to 7.0.1.100.
Affected products
- Lucee Association Lucee CFML Server 5.3.1.95 to 7.0.1.100 (including 5.3.x, 6.1.x, 6.2.x, and 7.0.x lines)
Timeline
- 2025-12-06: disclosed: Initial discovery by researcher Fouad Milat
- 2026-07-10: advisory: CVE published and NVD record created