CVE-2026-29519: Lucee

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.

Affected products

• Lucee Lucee: from 5.3.1.95, up to and including 7.0.0.395

Published 2026-07-10. Last modified 2026-07-14.