CVE-2026-48319: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Adobe ColdFusion 2025

CVE-2026-48319 is a path traversal vulnerability in Adobe ColdFusion 2025 where the software fails to properly restrict pathname access to a limited directory. An attacker possessing high privileges can exploit this flaw to execute arbitrary code with the current user's permissions. The vulnerability does not require user interaction and affects the confidentiality, integrity, and availability of the system, as reflected by a CVSS 3.1 score of 9.1 (critical). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with high privileges to execute arbitrary code in the context of the current user, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability, making it critical for affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to ColdFusion 2025 instances to trusted users only and monitor for suspicious activity related to path traversal attempts. Avoid granting unnecessary high privileges to users to reduce exploitation risk.