CVE-1999-0477: Allaire ColdFusion Server

High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days.

The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.

Affected products

• Allaire ColdFusion Server: version 2.0 only; version 3.0 only; version 3.01 only; version 3.11 only; version 3.12 only; version 4.0 only

Published 1999-12-25. Last modified 2026-06-16.