CVE-2026-27305 is a path traversal vulnerability in Adobe ColdFusion affecting versions 2023.18, 2025.6 and earlier. The flaw allows attackers to bypass pathname restrictions and access sensitive files and directories outside the intended scope. The vulnerability can be exploited remotely without authentication or user interaction, leading to potential disclosure of confidential information. The CVSS v3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation enables an attacker to read arbitrary files on the affected system, potentially exposing sensitive data. The confidentiality impact is high, but integrity and availability are not affected. This could lead to information disclosure that may facilitate further attacks or data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to ColdFusion services from untrusted networks and applying strict file system permissions to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.