CVE-2025-54261

Critical · 10.0

CVSS

10.0

EPSS

25.3%

Published

Sep 9, 2025

CISA due date

—

The record

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.

Affected packages

Ecosystem	Package	Introduced	Fixed