CVE-2025-54261: Adobe ColdFusion

Critical severity, CVSS 10.0. EPSS: 22.2% chance of exploitation in the next 30 days.

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.

Affected products

• Adobe ColdFusion: version 2021 only; version 2023 only; version 2025 only

Published 2025-09-09. Last modified 2026-06-17.