Read the docs
TI-2026-73522 Aliases CVE-2026-90530GHSA-r8v2-jg8h-rg32

Path traversal in Adobe ColdFusion RDS lets attackers read files

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Adobe ColdFusion 2025 through 2025.0.13 and Adobe ColdFusion 2023 through 2023.0.25 are affected. A path traversal flaw (CWE-22) in ColdFusion RDS lets a local attacker with no privileges read arbitrary files and directories outside the intended access scope, and no user interaction is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed ColdFusion 2025 (Adobe): 2025.0.14ColdFusion 2023 (Adobe): 2023.0.26

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeColdFusion 2025up to 2025.0.132025.0.14Patch availableCNA
AdobeColdFusion 2023up to 2023.0.252023.0.26Patch availableCNA
  • ColdFusion 2025 VendorAdobe Affected up to 2025.0.13 Fixed in 2025.0.14 Patch available CNA
  • ColdFusion 2023 VendorAdobe Affected up to 2023.0.25 Fixed in 2023.0.26 Patch available CNA

Remediation

Upgrade Adobe ColdFusion 2025 to 2025.0.14 and Adobe ColdFusion 2023 to 2023.0.26. Until then, switch ColdFusion to Production Secure Profile, which automatically disables RDS, or follow the Lockdown Guide to disable RDS on servers not in that profile.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA ColdFusion 2025 (Adobe) Fixed in 2025.0.14
  • Fix · CNA ColdFusion 2023 (Adobe) Fixed in 2023.0.26

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe ColdFusion 2023, ColdFusion 2025 — adobe.com/trust/security/products/coldfusion/apsb26-144.html

    31 records Highest priority Priority MEDIUM 16 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2026-73615 Code injection in Adobe ColdFusion lets attackers run arbitrary codePriority MEDIUM 51
    • TI-2026-73596 Unrestricted file upload in Adobe ColdFusion enables code executionPriority MEDIUM 51
    • TI-2026-73613 SSRF in Adobe ColdFusion could lead to privilege escalationPriority MEDIUM 50
    Show all 31 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-90530
  2. 2026-10-13 Alias added: GHSA-r8v2-jg8h-rg32
  3. 2026-10-14 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: MEDIUM → LOW
  5. 2026-10-14 Priority changed: LOW → MEDIUM

References

Advisory 2

Other 4

  • TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences