ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
Adobe · ColdFusion 2025
A path traversal flaw in the ColdFusion RDS component of Adobe ColdFusion 2025 allows an attacker to read arbitrary files on the file system, reaching sensitive files and directories outside the intended scope. The attacker needs local access to the system with no privileges and no user interaction required, and RDS is disabled automatically when ColdFusion runs in the Production Secure Profile, or can be disabled manually per the Lockdown Guide.
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 13 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.