CVE-2025-54261
Published: 09 September 2025
Summary
CVE-2025-54261 is a critical-severity Path Traversal (CWE-22) vulnerability in Adobe Coldfusion. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates pathname inputs to prevent path traversal exploits that bypass directory restrictions leading to arbitrary code execution.
Remediates the specific path traversal flaw in ColdFusion through timely identification, testing, and application of vendor patches from Adobe bulletin APSB25-93.
Enforces least functionality by disabling unnecessary optional configurations required for exploitation, reducing the attack surface for this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CWE-22) in public-facing ColdFusion server directly enables remote unauthenticated arbitrary code execution over the network.
NVD Description
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled.…
more
Scope is changed.
Deeper analysisAI
CVE-2025-54261 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified as CWE-22, affecting Adobe ColdFusion versions 2025.3, 2023.15, 2021.21, and earlier versions. This issue could enable arbitrary code execution by an attacker, but only if the victim has specific optional configurations enabled. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity and changed scope.
A remote, unauthenticated attacker can exploit this path traversal flaw over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to achieve arbitrary code execution on the targeted ColdFusion server, potentially compromising confidentiality, integrity, and availability with high impact.
Adobe's Security Bulletin APSB25-93 provides details on mitigation, available at https://helpx.adobe.com/security/products/coldfusion/apsb25-93.html.
Details
- CWE(s)