Platform
coldfusion
Component
coldfusion
Fixed in
2023.16
CVE-2025-61811 describes an Improper Access Control vulnerability in ColdFusion. This flaw allows a high-privileged attacker to bypass security measures and potentially execute arbitrary code. The vulnerability impacts ColdFusion versions from 0 through 2021.22. A fix is available in ColdFusion 2023.16.
This Path Traversal vulnerability grants an attacker the ability to access unauthorized files and directories on the server. Successful exploitation could lead to the disclosure of sensitive information, modification of system files, or even the execution of arbitrary code with the privileges of the ColdFusion user. The lack of user interaction required for exploitation significantly increases the risk, as attackers can potentially trigger the vulnerability remotely without any user action. The scope of the vulnerability is changed, meaning it can impact multiple areas of the system.
This CVE was published on December 9, 2025. Currently, there is no indication of active exploitation in the wild. The vulnerability's CRITICAL severity and ease of exploitation warrant close attention. No KEV listing is present as of this writing. Public proof-of-concept code is not yet available.
Exploit Status
EPSS
1.02% (77% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-61811 is to upgrade ColdFusion to version 2023.16 or later, which includes the necessary security patches. If immediate upgrading is not possible, consider implementing stricter access controls and file system permissions to limit the potential impact of a successful attack. Review and harden ColdFusion configuration settings to minimize the attack surface. While a WAF might offer some protection, it's not a substitute for patching.
Actualice ColdFusion a la versión 2023.16 o posterior. Esto solucionará la vulnerabilidad de path traversal y evitará la ejecución de código arbitrario. Consulte el aviso de seguridad de Adobe para obtener más detalles e instrucciones específicas.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-61811 is a critical vulnerability in ColdFusion allowing attackers to bypass security measures and potentially execute code. It affects versions 0–2021.22.
If you are running ColdFusion versions 0 through 2021.22, you are potentially affected. Upgrade to 2023.16 or later to mitigate the risk.
Upgrade ColdFusion to version 2023.16 or later. If upgrading is not immediately possible, implement stricter access controls and file system permissions.
As of December 2025, there is no confirmed evidence of active exploitation in the wild, but the vulnerability's severity warrants caution.
Refer to the Adobe Security Bulletin for ColdFusion for the official advisory and detailed information: [https://www.adobe.com/security/advisories/](https://www.adobe.com/security/advisories/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.