CVE-2026-48318 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in Adobe ColdFusion 2025. This flaw enables an attacker with low privileges to bypass directory restrictions and read arbitrary files on the server's file system. The vulnerability does not require user interaction and results in a changed security scope, affecting confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.9. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to read sensitive files and directories outside the intended access scope, potentially leading to disclosure of confidential information, system compromise, and disruption of service. The vulnerability affects confidentiality, integrity, and availability with critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to ColdFusion services and monitor for suspicious activity related to file access attempts. Avoid exposing ColdFusion instances to untrusted networks.