CVE-2025-61813 is an Improper Restriction of XML External Entity Reference (XXE) vulnerability in Adobe ColdFusion affecting versions 2025.4, 2023.16, 2021.22 and earlier. This vulnerability allows an attacker to exploit XML parsing to read arbitrary files on the server, potentially exposing sensitive information. Exploitation requires user interaction and the scope of impact is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component. The CVSS v3.1 base score is 8.2, reflecting high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected ColdFusion server, compromising confidentiality. The vulnerability does not impact integrity but has a low impact on availability. The scope change indicates that the vulnerability affects components beyond the original vulnerable code, potentially increasing the impact surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, organizations should consider mitigating exposure by restricting access to vulnerable ColdFusion instances and carefully validating or sanitizing XML inputs where possible. Monitor Adobe's official advisories for updates and apply patches promptly once released.