{"id":"CVE-2022-38418","published":"2022-10-14T19:42:55Z","modified":"2025-04-23T16:49:39Z","title":"Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"ColdFusion","versions":[">= unspecified, <= CF2021U4",">= unspecified, <= CF2018u14",">= unspecified, <= None"]}],"description":{"text":"Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"summary":{"text":"Adobe ColdFusion contains a path traversal flaw (CWE: Improper Limitation of a Pathname to a Restricted Directory) in the application server. An attacker with network access to the server can exploit it without authentication or user interaction, gaining arbitrary code execution in the context of the current user.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:49Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.80352,"percentile":0.99621,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-41003","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41003","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-10-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-38418","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9962"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-22"}}