CVE-2023-26361

What it actually does

The vulnerability is a path traversal flaw that allows an authenticated administrator to cause the affected application to read files outside the intended directory boundary. At a technical level, insufficient canonicalization or restriction of user-controlled path input lets traversal sequences resolve to arbitrary local filesystem paths. The primary security impact is confidentiality loss: an attacker with administrator-level access can read sensitive files such as configuration files, credentials, keys, logs, application source, or operating system files. The CVSS vector indicates network reachability, low attack complexity, no user interaction, high privileges required, unchanged scope, high confidentiality impact, and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose secrets and operational data stored on the server, including application credentials, database connection details, encryption material, internal configuration, and source code. Although exploitation requires administrator privileges and the issue is not listed in CISA KEV, the EPSS score is relatively high, so organizations running affected software should not treat it as purely theoretical. Exposure of configuration or credential files can enable follow-on compromise, lateral movement, data theft, or unauthorized access to connected systems. The supplied product metadata is inconsistent with the description: the vulnerability description identifies Adobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier, while the affected-product metadata references antonkueltz/fastecdsa; teams should validate applicability against their software inventory and vendor advisories before closure.

How an attack unfolds

An attacker first obtains or abuses administrator-level access to the affected application. From there, they interact with an administrative function that accepts or processes a filesystem path. By supplying a path containing traversal components or encoded traversal characters, the attacker causes the server-side code to resolve the requested path outside the permitted directory. If the vulnerable code reads and returns the file contents, the attacker can retrieve sensitive local files. The attacker typically prioritizes files likely to contain credentials or secrets, such as application configuration, datasource definitions, password stores, web application descriptors, logs, SSH keys, cloud credentials, and operating system account files. Information obtained through file reads may then be used to compromise databases, management consoles, service accounts, or adjacent systems. No named threat actor or public exploit maturity was supplied, and the issue is not identified as known exploited in CISA KEV, but elevated EPSS warrants monitoring for suspicious administrator activity and traversal-pattern requests.

How to fix it

Apply vendor fixes for every affected deployment. For Adobe ColdFusion, upgrade beyond the vulnerable releases identified in the advisory: ColdFusion 2018 Update 15 and earlier and ColdFusion 2021 Update 5 and earlier should be updated to the vendor-fixed update level or later. Where the supplied package metadata applies, update antonkueltz/fastecdsa to a version containing commit 4a16daeaf139be20654ef58a9fe4c79dc030458c. Because the product metadata conflicts with the vulnerability description, confirm the authoritative affected product and fixed version from the vendor advisory, package lockfiles, SBOMs, and runtime inventory. As compensating controls, restrict administrative interfaces to trusted networks or VPNs, require MFA for administrators, remove unnecessary administrator accounts, rotate credentials that may be stored on affected systems, enforce least privilege on the service account running the application, deny read access to sensitive files not required by the application, and monitor all administrator file-management or import/export functions. If exploitation is suspected, rotate any secrets stored on or accessible from the affected host after patching and forensic preservation.

How to confirm the fix worked

Confirm the running product version is no longer within the affected range and that the installed build or package includes the vendor fix. For ColdFusion, verify the installed update level from the administrative console, command-line version output, or installation metadata and confirm it is later than ColdFusion 2018 Update 15 or ColdFusion 2021 Update 5 as applicable. For the supplied Git package metadata, confirm the deployed source or dependency includes commit 4a16daeaf139be20654ef58a9fe4c79dc030458c or a later tag containing that commit. Review SBOMs, lockfiles, container images, golden images, and deployed artifacts to ensure no vulnerable versions remain. From a controlled test environment, verify that administrative file-handling functions reject traversal input, encoded traversal input, absolute paths outside approved directories, Windows drive-letter paths, UNC paths, and symlink escapes. Validation should confirm that rejected attempts are logged, that only expected files can be read, and that administrative interfaces remain restricted to approved users and networks.

Typical attack path

1. Obtain valid administrator privileges for the affected application through prior compromise, stolen credentials, phishing, password reuse, or insider misuse.
2. Access an administrative feature that accepts, imports, previews, opens, downloads, or validates a file path.
3. Submit traversal sequences such as parent-directory references or URL-encoded equivalents to escape the intended directory.
4. Read sensitive local files that should not be accessible through the application interface.
5. Extract credentials, keys, configuration values, source code, or internal endpoint information from the returned file contents.
6. Use the recovered secrets or intelligence for follow-on access to databases, application servers, cloud services, or management interfaces.
7. Delete or obscure evidence where possible, commonly by relying on normal-looking authenticated administrator sessions.

How to detect it

To determine whether exploitation already occurred, review logs from the affected application, administrator console, web server, reverse proxy, WAF, identity provider, EDR, and operating system. Focus on authenticated administrator sessions that accessed file-management, import/export, package, archive, template, download, preview, or configuration functions and included traversal strings, encoded traversal characters, absolute paths, or sensitive filenames. Correlate suspicious requests with successful HTTP 200 responses, unusual response sizes, repeated probing across operating system paths, and administrator logins from unusual IP addresses, geographies, user agents, or times. For ColdFusion-like deployments, examine access logs under web server and ColdFusion log locations for requests to administrative paths combined with path traversal sequences or sensitive file targets. Review application logs for file-open errors, invalid path errors, access denied events, canonicalization failures, and exceptions that include local filesystem paths. On hosts, look for evidence that sensitive files were read by the application service account around the same timestamps, including EDR file-read telemetry, auditd events, Windows object access auditing, Sysmon file events where enabled, and shell history if an administrator session was abused interactively. Investigate any reads of configuration files containing credentials, datasource definitions, keystores, private keys, cloud credential files, password stores, and system account files. If logs are unavailable or incomplete, assume secrets stored on the affected host may have been exposed and rotate them after patching.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\boot.ini
• C:\\Windows\\System32\\config\\SAM
• WEB-INF/web.xml
• neo-security.xml
• neo-datasource.xml
• neo-runtime.xml
• neo-cron.xml
• password.properties
• application.properties
• application.yml
• .env
• id_rsa
• id_dsa
• authorized_keys
• credentials.xml
• keystore.jks
• applicationHost.config
• /CFIDE/administrator
• /cfide/administrator
• Traversal
• path traversal
• Invalid path
• Access denied reading file
• FileNotFoundException
• java.io.FilePermission
• java.nio.file.AccessDeniedException

What your security team should do

• Prioritize inventory validation because the supplied metadata conflicts: identify whether Adobe ColdFusion, antonkueltz/fastecdsa, or both are present and whether affected versions are deployed.
• Patch or upgrade affected deployments promptly; use the exact fixed commit 4a16daeaf139be20654ef58a9fe4c79dc030458c where the antonkueltz/fastecdsa metadata applies, and apply the vendor-fixed ColdFusion update for affected ColdFusion versions.
• Restrict administrative interfaces to trusted administrative networks, enforce MFA, and disable or remove stale administrator accounts.
• Review administrator account activity since publication on 2023-03-23, especially file access, import/export, template, package, archive, or configuration-management actions.
• Search web, application, reverse proxy, and WAF logs for traversal patterns and attempts to access sensitive files.
• If suspicious reads are found, preserve logs and disk artifacts, rotate credentials and keys stored on the host, and investigate connected systems that may have been accessed using exposed secrets.
• Harden filesystem permissions so the application runtime cannot read sensitive operating system, credential, or backup files that are not required for normal operation.
• Add detection rules for authenticated requests containing traversal sequences, encoded traversal strings, absolute filesystem paths, and sensitive filename targets.
• Review dependency and container build pipelines to ensure fixed versions are pinned and vulnerable artifacts are not reintroduced.