CVE-2023-26361
Published: 23 March 2023
Summary
CVE-2023-26361 is a medium-severity Path Traversal (CWE-22) vulnerability in Adobe Coldfusion. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe ColdFusion versions 2018 Update 15 and earlier, along with 2021 Update 5 and earlier, are affected by a path traversal vulnerability tracked as CWE-22. The flaw permits arbitrary file system reads and carries a CVSS 4.9 rating reflecting network accessibility, low attack complexity, and high confidentiality impact when successfully exploited.
An authenticated administrator can leverage the issue without user interaction to read arbitrary files on the server. No other privileges or special conditions are required beyond the administrative account.
Adobe published mitigation guidance and patch information in advisory APSB23-25, available at https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html.
The associated EPSS score rose from a lower baseline to a peak of 0.3213 on 2025-12-11 before receding to the current value of 0.1289, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30182
Vulnerability details
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of…
more
this issue does not require user interaction, but does require administrator privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.