ColdFusion | Unzureichende Beschränkung eines Pfadnamens auf ein eingeschränktes Verzeichnis ('Path Traversal') (CWE-22)

The primary impact of CVE-2026-34619 is the potential for unauthorized access to files and directories on the ColdFusion server. An attacker exploiting this vulnerability could read configuration files, source code, or other sensitive data that is not intended to be publicly accessible. This could lead to information disclosure, privilege escalation, or even remote code execution if the attacker can leverage the accessed files to compromise the system further. The lack of user interaction required for exploitation significantly increases the risk, as an attacker can trigger the vulnerability remotely without needing to trick a user into performing any action.

Organizations running ColdFusion applications, particularly those with sensitive data stored on the server, are at risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a compromise of one user's ColdFusion application could potentially expose data from other users.

• coldfusion: Examine ColdFusion request logs for suspicious patterns like '../' or '\\'. • generic web: Use curl to test for path traversal by attempting to access files outside the expected directory structure. For example: curl 'http://coldfusion-server/..\.\.\.\.\/etc/passwd' • generic web: Check access and error logs for unusual file access attempts or errors related to unauthorized file access. • generic web: Review response headers for unexpected content or file types.

1. 2026-04-14Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-14
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-22

The recommended mitigation for CVE-2026-34619 is to immediately upgrade to ColdFusion version 2025.6 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the ColdFusion directory through web application firewalls (WAFs) or proxy servers. Configure WAF rules to block requests containing suspicious path traversal patterns (e.g., '../'). Regularly review and harden ColdFusion configuration settings to minimize the attack surface. After upgrading, verify the fix by attempting to access files outside the intended directory through a web browser or other HTTP client; access should be denied.