{"id":"CVE-2022-38421","published":"2022-10-14T19:42:56Z","modified":"2025-04-23T16:48:45Z","title":"Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"ColdFusion","versions":[">= unspecified, <= CF2021U4",">= unspecified, <= CF2018u14",">= unspecified, <= None"]}],"description":{"text":"Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a path traversal weakness (improper limitation of a pathname to a restricted directory) in Adobe ColdFusion, affecting Update 14 and earlier and Update 4 and earlier. An attacker who exploits it can achieve arbitrary code execution in the context of the current user, without requiring user interaction, but only if they already hold administrator privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:12Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.79558,"percentile":0.99604,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-41006","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41006","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-10-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-38421","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9960"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-22"}}