CVE-2026-90530: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Adobe ColdFusion 2025
Description
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
CVSS v3.1
Score 9.3critical
Affected software
Adobe
ColdFusion 2025
Adobe
ColdFusion 2023
pkg:maven/com.adobe/coldfusionRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90530 is a path traversal vulnerability (CWE-22) affecting Adobe ColdFusion 2025's RDS feature. It allows an attacker to bypass pathname restrictions and read arbitrary files on the file system, potentially exposing sensitive information. The vulnerability does not require user interaction and changes the security scope. RDS is a development-only feature that is automatically disabled in Production Secure Profile, reducing risk in production environments.
Potential Impact
Successful exploitation can lead to full confidentiality, integrity, and availability impact (CVSS 9.3) by allowing attackers to read sensitive files outside the intended directories. This could expose critical system or application data, potentially leading to further compromise.
Mitigation Recommendations
Adobe recommends disabling the RDS feature when ColdFusion is not running in Production Secure Profile. Switching to Production Secure Profile automatically disables RDS, effectively mitigating this vulnerability. Follow the Adobe ColdFusion Lockdown Guide for detailed steps to disable RDS if Production Secure Profile is not used. Patch status is not confirmed; check Adobe advisories for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- adobe
- Date Reserved
- 2026-09-12T11:06:59.201Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace95e32cdf04f656aad86a
Added to database: 10/13/2026, 20:34:43 UTC
Last enriched: 10/13/2026, 20:48:32 UTC
Last updated: 10/13/2026, 21:05:53 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.