CVE-2026-48338 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in Adobe ColdFusion 2025. This flaw enables an attacker with low privileges to read arbitrary files on the file system outside the intended restricted directories. Exploitation does not require user interaction, and the vulnerability changes the scope of security control. The CVSS v3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, no user interaction, and results in high confidentiality impact without affecting integrity or availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to read sensitive files and directories outside the intended access scope, potentially exposing confidential information. The vulnerability affects confidentiality but does not impact integrity or availability. The attack requires low privileges and adjacent network access, increasing the risk in environments where an attacker can reach the affected system on the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted users only and monitor for suspicious file access patterns related to ColdFusion. Avoid exposing ColdFusion services to untrusted networks.