Adobe ColdFusion 2025 Update 4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*

part: a version: 2025 update: update4

VendorAdobe (fb293c1b-cab3-5565-9184-186e4ece530b)
ProductColdfusion (db90b161-3a2c-5267-99af-6a14e5723f4c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-48338 vulnerable 2026-07-29 00:55:01.323878 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
MEDIUM (6.8)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-07-14T21:04:11.745Z
Updated: 2026-07-16T15:01:16.864Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-34619 vulnerable 2026-06-08 07:59:12.811608 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
HIGH (7.7)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:59.589Z
Updated: 2026-04-15T17:42:57.834Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27308 vulnerable 2026-06-08 07:53:22.194808 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:58.735Z
Updated: 2026-04-15T17:31:46.019Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27307 vulnerable 2026-06-08 07:53:22.193115 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:53.899Z
Updated: 2026-04-15T17:33:11.891Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27306 vulnerable 2026-06-08 07:53:22.191090 ColdFusion | Improper Input Validation (CWE-20)
HIGH (8.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-04-14T21:53:54.863Z
Updated: 2026-04-15T09:13:11.287Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27305 vulnerable 2026-06-08 07:53:22.185586 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27304 vulnerable 2026-06-08 07:53:22.184011 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27282 vulnerable 2026-06-08 07:53:22.160389 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64898 vulnerable 2026-06-08 07:39:20.405792 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64897 vulnerable 2026-06-08 07:39:20.393967 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61823 vulnerable 2026-06-08 07:37:28.224221 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61822 vulnerable 2026-06-08 07:37:28.221067 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61821 vulnerable 2026-06-08 07:37:28.212331 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61813 vulnerable 2026-06-08 07:37:28.163815 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61812 vulnerable 2026-06-08 07:37:28.160652 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61811 vulnerable 2026-06-08 07:37:28.158081 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61810 vulnerable 2026-06-08 07:37:28.154621 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61809 vulnerable 2026-06-08 07:37:28.146067 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61808 vulnerable 2026-06-08 07:37:28.142330 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.