CRITICAL🇵🇱 Wersja polska

CVE-2026-48276

CVSS 10.0v3.1pub. 2026-06-30upd. 2026-08-28

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Adobe Coldfusion

    APP
    Adobe
    20232025
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-48282CRITICAL10.0⚠ KEVPL ✓same product

Adobe ColdFusion: Path Traversal umożliwiający zdalne wykonanie kodu (RCE)

CVE-2023-38203CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — RCE poprzez Deserialization niezaufanych danych

CVE-2023-29300CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — RCE przez Deserialization of Untrusted Data

CVE-2023-26359CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — krytyczna podatność deserialization umożliwiająca RCE

CVE-2018-15961CRITICAL9.8⚠ KEVPL ✓same product

Adobe ColdFusion — nieograniczony upload pliku prowadzący do RCE