CVE-2026-48313

Path traversal is a mistake where software lets an attacker “walk” to the wrong folder by using special characters in a file path. In ColdFusion, that can mean an attacker reaches files outside the folders the application was supposed to be able to access. Depending on what the app is allowed to do, the attacker may be able to read sensitive files and sometimes make limited changes.

This matters if your business runs Adobe ColdFusion (especially versions 2025.9, 2023.20, or earlier). Because the findings say no authentication and no user action are required, internet exposure is a key concern. Treat it as a risk if your ColdFusion application is reachable over the network (for example, exposed to the internet) and uses the vulnerable file-path handling paths in the product.

This should be treated as an urgent security update because the vulnerability is network-reachable and does not require a login or user action. Even though there’s no confirmed public exploit code listed and KEV is not populated, the combination of “no authentication” and “file access outside intended folders” makes it important to fix promptly.