Adobe ColdFusion path traversal — CVSS 9.1
Path traversal in Adobe ColdFusion allows an unauthenticated remote attacker to read arbitrary files on the server. Patched in ColdFusion 2025 Update 11 and 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2023, ColdFusion 2025
- CVSS
- 9.1
- EPSS (exploit probability)
- 1.4%
- Status
- patched
- Published
Is CVE-2026-48319 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48319 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
A path traversal vulnerability in Adobe ColdFusion allows an unauthenticated remote attacker to access files outside of the intended directory, potentially exposing sensitive server-side configuration and credentials. Part of Adobe’s July 2026 ColdFusion update batch fixing eight critical vulnerabilities.
Apply ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22. See also CVE-2026-48318, a higher-severity path traversal (CVSS 9.9) in the same update batch.
Source: NVD · Adobe Security Bulletin
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
