/Vulnerability Library

Adobe ColdFusion - RDS Arbitrary File Write

CVE-2026-48282
Verified

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.

Severity

Critical

CVSS Score

10

Exploit Probability

42%

Published Date

July 3, 2026

Template Author

watchtowr, dhiyaneshdk

CVE-2026-48282.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-48282
CWE ID:
cwe-22

References

https://helpx.adobe.com/security/products/coldfusion/apsb26-68.htmlhttps://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/

Remediation Steps

Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.