CVE-2026-48318 is a critical path traversal vulnerability in Adobe ColdFusion 2025. It allows an attacker with low privileges and no user interaction to bypass pathname restrictions and access arbitrary files on the file system outside the intended restricted directories. This vulnerability affects the confidentiality, integrity, and availability of the system, as indicated by a CVSS 3.1 score of 9.9 with scope change. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated.

Successful exploitation can lead to arbitrary file system read, exposing sensitive files and directories outside the intended access scope. The vulnerability impacts confidentiality, integrity, and availability, potentially allowing attackers to gain sensitive information, manipulate data, or disrupt service. The scope of the vulnerability is changed, indicating that the attacker can affect resources beyond their original privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ColdFusion services and monitor for suspicious activity related to file access attempts. Avoid exposing ColdFusion instances to untrusted networks.