Introduction
An unauthenticated path traversal flaw in Adobe ColdFusion lets any network-based attacker read arbitrary files from the server's file system, with no user interaction required. CVE-2026-27305 was disclosed on April 14, 2026 in Adobe's APSB26-38 bulletin. It carries a CVSS 3.1 base score of 8.6, and Adobe has rated it Priority 1, its highest remediation urgency.
ColdFusion is a commercial platform for rapid web application development, created in 1995 and now maintained by Adobe. Its market share in the application development category is relatively small (estimated at between 0.03 and 0.25 percent), but it is frequently deployed in enterprise environments to run business-critical applications. That makes it a disproportionately attractive target for adversaries seeking sensitive data.
Technical Information
CVE-2026-27305 falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly called path traversal. ColdFusion does not adequately validate or sanitize file path inputs before it resolves them against the server's file system. An attacker can supply directory traversal sequences that escape the intended document root and reach arbitrary locations on disk.
The CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, which breaks down as follows:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No victim action required |
| Scope | Changed | Impact extends beyond the vulnerable component |
| Confidentiality | High | Full read access to the file system |
| Integrity | None | No write capability |
| Availability | None | No denial of service |
The "Changed" scope means a successful exploit affects resources beyond the security scope of the vulnerable ColdFusion component itself. In practice, an attacker who exploits this flaw could extract configuration files, database credentials, API keys, or other sensitive data from anywhere on the file system that the ColdFusion process can read. The attacker could then use that data to further compromise the system or the wider network.
Adobe's patches update the adminapi, administrator, and CCS packages, which strongly suggests the traversal issue is in ColdFusion's administrative or core container subsystem. The fix likely sanitizes or restricts file path inputs that were previously resolved against the file system without adequate boundary checks, so that directory traversal sequences such as ../ can no longer escape the intended document root.
An attack would proceed as follows:
- Identify an internet-facing ColdFusion instance running a vulnerable version (Update 6 or earlier for ColdFusion 2025, Update 18 or earlier for ColdFusion 2023).
- Craft a request to the vulnerable endpoint within the administrative or core container subsystem, injecting directory traversal sequences into a file path parameter.
- The server resolves the manipulated path without proper validation and reads the targeted file from the file system.
- The server returns the file contents to the attacker, who can then harvest credentials, configuration data, or other sensitive information.
Because the attack needs no authentication and has low complexity, the whole chain can be automated at scale against exposed ColdFusion deployments.
Patch Information
Adobe fixed CVE-2026-27305 on April 14, 2026 in security bulletin APSB26-38 and rated it Priority 1, its highest urgency tier. Two fixed product updates were released at the same time:
| Product | Vulnerable Versions | Fixed Version | Build Number |
|---|---|---|---|
| ColdFusion 2025 | Update 6 and earlier | Update 7 | 2025,0,07,331586 |
| ColdFusion 2023 | Update 18 and earlier | Update 19 | 2023,0,19,330899 |
Both updates also include additional hardening. ColdFusion 2025 Update 7 upgrades the embedded Tomcat engine to 10.1.53.0, and ColdFusion 2023 Update 19 upgrades its embedded Tomcat to 9.0.116.0.
The updates are cumulative, so administrators do not need to apply every intermediate update before moving to the fixed release. There are two ways to install them:
Using ColdFusion Administrator Package Manager: Navigate to Package Manager, select Packages, and click Check for Updates in the Core Server section. When the update is detected, click Update to apply the latest core package and all installed packages. Restart ColdFusion for the changes to take effect.
Offline installation: Download the hotfix installer JAR file directly:
- CF 2025 Update 7:
hotfix-007-331586.jarfromcfdownload.adobe.com - CF 2023 Update 19:
hotfix-019-330899.jarfromcfdownload.adobe.com
For JEE (non-standalone) deployments, Adobe requires configuring the jdk.serialFilter JVM flag as an additional layer of deserialization protection. The flag is set in the application server startup file (for example, Catalina.bat/sh for Tomcat, startWeblogic.cmd for WebLogic, or standalone.conf for WildFly/EAP), and you should verify it as part of any update procedure.
After applying the updates, verify the installation by checking the ColdFusion build number:
- ColdFusion 2025 Update 7 should report
2025,0,07,331586 - ColdFusion 2023 Update 19 should report
2023,0,19,330899
Adobe also recommends applying the security configuration settings in the ColdFusion 2025 and 2023 Lockdown Guides and updating the MySQL Java Connector to the latest version.
Jonathan Lein of TrendAI Research is credited with reporting CVE-2026-27305. He also reported two other issues in the same bulletin (CVE-2026-27282 and CVE-2026-34619).
Affected Systems and Versions
The following ColdFusion versions are confirmed vulnerable:
- ColdFusion 2025: Update 6 and all earlier updates
- ColdFusion 2023: Update 18 and all earlier updates
Any network-reachable deployment of these versions, standalone or JEE-based, is at risk. Internet-facing instances face the highest risk, because exploitation requires no authentication and no user interaction.
Vendor Security History
Adobe has a well-documented history of patching critical ColdFusion vulnerabilities. The APSB26-38 bulletin that fixes CVE-2026-27305 also patches multiple other critical flaws, including an arbitrary code execution vulnerability (CVE-2026-27304), security feature bypasses, and a second path traversal vulnerability (CVE-2026-34619).
This has happened before. An earlier ColdFusion arbitrary file read vulnerability, CVE-2024-20767, was actively exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog. Security researchers also observed thousands of malicious requests targeting ColdFusion file read flaws during holiday periods, when security teams are typically understaffed.
CWE-22 flaws keep recurring in ColdFusion, which makes rapid patching important, along with defense-in-depth measures such as the ColdFusion Lockdown Guides. Adobe had not reported active exploitation of CVE-2026-27305 at the time of disclosure. The history, though, strongly suggests that threat actors will reverse-engineer the patches and develop working exploits quickly.
References
- Adobe Security Bulletin APSB26-38
- NVD Entry for CVE-2026-27305
- ColdFusion 2025 Update 7 Tech Notes
- ColdFusion 2023 Update 19 Tech Notes
- Tenable CVE-2026-27305
- CIS Advisory: Multiple Vulnerabilities in Adobe Products
- SentinelOne: CVE-2024-20767 Adobe ColdFusion Information Disclosure
- CrowdSec: CVE-2024-20767 Active Exploitation in Adobe ColdFusion
- Security Affairs: Thousands of ColdFusion Exploit Attempts
- ColdFusion 2023 Release Updates
