{"id":"CVE-2010-2861","published":"2010-08-11T18:47:51Z","modified":"2026-10-02T14:55:20Z","title":"Adobe ColdFusion Directory Traversal Vulnerability","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"description":{"text":"Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a set of directory traversal vulnerabilities in the administrator console of Adobe ColdFusion 9.0.1 and earlier, where the locale parameter is not properly restricted in several administrator pages. A remote attacker who can reach the administrator console over the network can read arbitrary files on the server by manipulating the locale parameter, with no authentication or user interaction required and no special configuration needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99747,"percentile":0.99954,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-2861","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-09-21","exploitedFirstSeen":"2021-09-21","ransomware":true,"evidence":[{"url":"https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/","date":"2021-09-21"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf","date":"2021-11-10"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://www.greynoise.io/blog/battling-ransomware-one-tag-at-a-time","date":"2024-02-08"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389","date":"2025-01-21"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a","date":"2025-02-19"},{"url":"https://www.cyfirma.com/research/tracking-ransomware-february-2025/","date":"2025-03-13"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2010-2861","date":"2025-06-07"},{"url":"https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-and-financial-attacks-on-industrial-organizations-in-Q1-2025-En.pdf","date":"2025-06-19"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://securityreason.com/securityalert/8137","tags":["Broken Link"]},{"url":"http://securityreason.com/securityalert/8148","tags":["Broken Link"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-18.html","tags":["Not Applicable","Vendor Advisory"]},{"url":"http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/","tags":["Exploit"]},{"url":"http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07","tags":["Broken Link"]},{"url":"http://securityreason.com/securityalert/8137","tags":["Broken Link"]},{"url":"http://securityreason.com/securityalert/8148","tags":["Broken Link"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-18.html","tags":["Not Applicable","Vendor Advisory"]},{"url":"http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/","tags":["Exploit"]},{"url":"http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.","confidence":"high"},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-2865","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2865","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":14641,"url":"https://www.exploit-db.com/exploits/14641","title":"Adobe ColdFusion - Directory Traversal","type":"remote","platform":"multiple","date":"2010-08-14","verified":true,"provenance":"source"},{"id":16985,"url":"https://www.exploit-db.com/exploits/16985","title":"Adobe ColdFusion - Directory Traversal (Metasploit)","type":"remote","platform":"multiple","date":"2011-03-16","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2010-08-14"},"pocGithub":{"count":2,"skipped":0,"earliest":"2025-10-22","earliestUrl":"https://github.com/greysneakthief/14641-v2","repos":[{"name":"greysneakthief/14641-v2","url":"https://github.com/greysneakthief/14641-v2","stars":0,"created":"2025-10-22"},{"name":"CyberCTF/vulhub-coldfusion-cve-2010-2861","url":"https://github.com/CyberCTF/vulhub-coldfusion-cve-2010-2861","stars":0,"created":"2026-10-08"}]},"metasploit":[{"name":"ColdFusion Server Check","module":"auxiliary/scanner/http/coldfusion_locale_traversal","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb"}],"nuclei":[{"id":"CVE-2010-2861","name":"Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI","severity":"high","path":"http/cves/2010/CVE-2010-2861.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-2861.yaml"}],"first":{"date":"2010-08-14","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/14641"},"provenance":"source"},"exploitRefs":["http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1119"],"provenance":"source"}],"timeline":[{"date":"2010-08-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2861","provenance":"source"},{"date":"2010-08-14","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-14641); later: PoC-in-GitHub 2025-10-22","url":"https://www.exploit-db.com/exploits/14641","provenance":"source"},{"date":"2021-09-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2865","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"Exploit-DB","daysToKev":4244},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1864 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-22"}}