Executive brief
Adobe ColdFusion, a platform for building and deploying web applications, is affected by a security flaw that could allow an attacker to run unauthorized commands on a server. To exploit this, an attacker would need to trick a legitimate user into opening a specially crafted malicious file. If successful, the attacker could gain full control over the application environment, potentially leading to data theft or service disruption.
Technical details
This vulnerability (CWE-427) is an uncontrolled search path element flaw in Adobe ColdFusion. It occurs when the application uses a fixed or relative path to look for resources (like DLLs or scripts) but does not properly validate the search path, allowing an attacker to place a malicious file in a location that the application searches. The attack vector is local and requires user interaction, meaning a victim must be persuaded to open a malicious file. Successful exploitation allows for arbitrary code execution with the privileges of the current user and involves a scope change, potentially impacting the underlying host system. Adobe has addressed this in security bulletin APSB26-68.
Affected products
- Adobe ColdFusion 2025.9, 2023.20 and earlier
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory