Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-90530: ColdFusion RDS can expose any file
CVE-2026-90530 · published today
Summary
Adobe ColdFusion 2025 and 2023 include a Remote Development Service (RDS) that can be tricked into reading files outside its allowed folder. This could let an attacker view confidential data on the server without any user interaction. Disable RDS or switch the server to the Production Secure Profile to block the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | coldfusion 2025 | <= 2025.0.13 |
| adobe | coldfusion 2023 | <= 2023.0.25 |
Original advisory text
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
References
- https://www.stigviewer.com/stigs/adobe_coldfusion/2026-05-13/finding/V-279042 third-party-advisory
- https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/ins... mitigation
- https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html vendor-advisory
- https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-dev... mitigation
- https://helpx.adobe.com/coldfusion/configuring-administering/administering-coldf... mitigation
- https://www.adobe.com/cc-shared/assets/pdf/products/coldfusion-family/coldfusion... mitigation
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-22Path Traversal
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta