ColdFusion fails to properly restrict the type of files that can be uploaded through certain endpoints, allowing an attacker to upload files with dangerous extensions (e.g., executable scripts) instead of the expected data types.

ColdFusion 2025 (Update 9 and earlier), ColdFusion 2023 (Update 20 and earlier).

An unauthenticated attacker uploads a malicious script disguised as an allowed file type to a reachable upload endpoint. Once stored on the server, the file can be invoked to execute arbitrary code with the privileges of the ColdFusion application. Public analysis (watchTowr Labs, Sina Kheirkhah) notes the patch adds newly disallowed extensions (.jspf, .cfmail, .war, among others) and new path-traversal checks in the upload handler — meaning the upload path itself could also be manipulated to place the file somewhere unintended.

CERTVU recommends the following:

• Patch immediately: Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 as applicable. Given four CVEs in this batch are CVSS 10.0 and unauthenticated, treat this as urgent — Adobe itself has flagged that AI-assisted vulnerability research is compressing exploit timelines from days to hours.
• Reduce exposure now, patch after:
  • If file upload functionality is enabled anywhere in your ColdFusion deployment, verify authentication is enforced on the upload endpoint and consider disabling uploads until patched.
  • Restrict network access to ColdFusion admin/management interfaces to trusted internal networks or VPN.
  • Review outbound request capability from ColdFusion (relevant to the SSRF flaw) and restrict where the server itself can reach.