ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

This Path Traversal vulnerability grants an attacker the ability to access unauthorized files and directories on the server. Successful exploitation could lead to the disclosure of sensitive information, modification of system files, or even the execution of arbitrary code with the privileges of the ColdFusion user. The lack of user interaction required for exploitation significantly increases the risk, as attackers can potentially trigger the vulnerability remotely without any user action. The scope of the vulnerability is changed, meaning it can impact multiple areas of the system.

Organizations running ColdFusion in production environments, particularly those with older, unpatched versions (0–2021.22), are at significant risk. Shared hosting environments where ColdFusion instances are deployed alongside other applications are also vulnerable, as a compromise of one instance could potentially lead to the compromise of others.

• coldfusion / server:

find /opt/coldfusion/cfusion/wwwroot/ -name '*.*' -type f -print0 | xargs -0 grep -i 'path.xml'

• coldfusion / server:

journalctl -u coldfusion -g "path traversal"

• generic web:

curl -I http://your-coldfusion-server/CFIDE/administrator/enter.cfm?locale=en&path=../../../../etc/passwd

1. 2025-12-09Disclosure

   disclosure

1. आरक्षित2025-10-01
2. प्रकाशित2025-12-09
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-61811 is to upgrade ColdFusion to version 2023.16 or later, which includes the necessary security patches. If immediate upgrading is not possible, consider implementing stricter access controls and file system permissions to limit the potential impact of a successful attack. Review and harden ColdFusion configuration settings to minimize the attack surface. While a WAF might offer some protection, it's not a substitute for patching.