CVE-2026-48313 is a path traversal vulnerability in Adobe ColdFusion that improperly limits pathname access to restricted directories. This flaw enables attackers to access sensitive files and directories beyond the intended scope, potentially leading to arbitrary file reads and limited writes. The vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. Exploitation requires no user interaction and changes the security scope, impacting confidentiality and integrity. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, high confidentiality impact, limited integrity impact, and no availability impact. As of the published date, no patch or official remediation level has been disclosed by Adobe.

Successful exploitation allows remote attackers to read arbitrary files and perform limited writes outside the intended directory restrictions, compromising confidentiality and partially compromising integrity of the affected system. This can lead to exposure of sensitive information and potential unauthorized modifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to ColdFusion services and monitor for suspicious activity related to file access attempts. Follow Adobe's official channels for updates on patches or mitigations.