CVE-2026-27305: Path Traversal in ColdFusion

The impact of this vulnerability is significant due to its potential for unauthorized access to sensitive data. An attacker could exploit this flaw to read configuration files, source code, database credentials, or other confidential information stored on the server. Successful exploitation could lead to data breaches, compromise of system integrity, and potential lateral movement within the network if credentials are exposed. The lack of user interaction required for exploitation further increases the risk, as the vulnerability can be triggered remotely without any user action.

1. Reserved2026-02-18
2. Published2026-04-14
3. Modified2026-04-16
4. EPSS updated2026-04-22

The primary mitigation for CVE-2026-27305 is to upgrade to ColdFusion version 2025.6 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting file system access through web server configuration or employing a Web Application Firewall (WAF) to filter requests that attempt to access files outside the intended directory. Regularly review and harden ColdFusion's configuration to minimize the attack surface. After upgrading, verify the fix by attempting to access files outside the intended directory and confirming that access is denied.