CVE-2026-27305 describes an improper limitation of a pathname to a restricted directory vulnerability in Adobe ColdFusion. This path traversal flaw enables remote attackers to bypass directory restrictions and read arbitrary files on the server file system. The vulnerability affects ColdFusion versions 2023.18, 2025.6, and earlier. Exploitation does not require user interaction, increasing the risk of automated or remote attacks. The CVSS v3.1 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to read sensitive files outside the intended directory scope, potentially exposing confidential data. The vulnerability does not impact integrity or availability but poses a significant confidentiality risk. Because no privileges or user interaction are required, the attack surface is broad and can be triggered remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to ColdFusion servers and monitoring for suspicious file access patterns. Avoid exposing ColdFusion instances directly to untrusted networks. Follow Adobe's official channels for updates on patches or mitigations.