CVE-2026-48314 is a path traversal vulnerability in Adobe ColdFusion affecting versions 2025.9, 2023.20, and earlier. It arises from improper limitation of a pathname to a restricted directory, enabling attackers to bypass security controls and access files or directories beyond intended restrictions. Exploitation requires no user interaction and can be performed remotely. The vulnerability impacts confidentiality and integrity by allowing limited unauthorized read and write operations. No official patch or remediation level has been published by Adobe at this time.

An attacker exploiting this vulnerability can bypass security restrictions to gain limited read and write access to files or directories outside the intended restricted areas. This compromises confidentiality and integrity of the affected system. There is no indication of impact to availability. No known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor Adobe's advisories for updates. Until a fix is available, restrict network access to ColdFusion instances and apply any recommended configuration hardening to limit exposure.