Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-105899: ColdFusion 2025 and 2023 allow dangerous file upload
CVE-2026-105899 · published today
Summary
Adobe ColdFusion versions 2025 and 2023 let attackers upload files of any type without checks. A malicious file could run code on the server, giving the attacker the same rights as the web application. Apply the vendor's security update or block file uploads until the patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | coldfusion 2025 | <= 2025.0.13 |
| adobe | coldfusion 2023 | <= 2023.0.25 |
Original advisory text
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-434Unrestricted File Upload
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta