CVE-2025-61813 is an XXE vulnerability in Adobe ColdFusion that affects versions 2025.4, 2023.16, 2021.22 and earlier. The flaw allows an attacker to perform arbitrary file system reads by exploiting improper restrictions on XML external entity references. Exploitation requires user interaction and the scope is changed, indicating that the attack can affect resources beyond the initially vulnerable component. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, changed scope, and high impact on confidentiality.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the server, compromising confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction, which may limit exploitation scenarios. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Adobe's advisories for updates. Until a fix is available, limit exposure by restricting user input that triggers XML processing and consider disabling XML external entity processing if feasible.