CVE-2026-48318

Critical · CVSS 9.9

Adobe ColdFusion — Path Traversal arbitrary file read (CWE-22)

CVSS: 9.9; nvd
EPSS: 6.68%; 93th pct
KEV: No
Class: other; CWE-22

Description

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

Search profile — drives PoC discovery

Symbols path traversaldirectory traversalfile readrestricted directoryAPSB26-82CVE-2026-48318

Keywords CVE-2026-48318ColdFusion path traversalColdFusion arbitrary file readAPSB26-82ColdFusion directory traversalColdFusion CWE-22ColdFusion file system read PoC

Versions: versions affected per APSB26-82

References

https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html

Status: enriched · ingested 2026-07-15T18:00:20.000Z · profiled 2026-07-15T18:30:20.000Z