Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-48283

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

View on NVD

Analysis

Adobe ColdFusion presenta una vulnerabilidad crítica de subida de archivos sin restricciones que permite la ejecución remota de código arbitrario sin intervención del usuario. Es imperativo actualizar las versiones 2025.9 y 2023.20 o anteriores para evitar que un atacante tome el control total del entorno de ejecución.

Relevant roles

BackendCyberSecurityJavaCloud

Severity

Score: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-434

EPSS

No EPSS score yet (CVE may be too fresh).

Technical description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Published: 6/30/2026, 4:16:54 PM
Last modified: 6/30/2026, 4:16:54 PM

References

HomeEventsBlogResourcesTeam