Adobe · ColdFusion
CVE-2026-48282
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
这是什么
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
CISA: Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
该怎么做
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
美国联邦机构的修复期限：2026年7月10日
Adobe 的其他被利用漏洞
| 加入日期 | 漏洞 | 产品 | 严重程度 | 受攻击概率 |
|---|---|---|---|---|
| 2025年2月24日 | Deserialization | ColdFusion | 严重 9.8 | 91% |
| 2024年12月16日 | Improper Access Control | ColdFusion | 高 7.4 | 99% |
| 2024年1月8日 | Deserialization of Untrusted Data | ColdFusion | 严重 9.8 | >99.9% |
| 2024年1月8日 | Deserialization of Untrusted Data | ColdFusion | 严重 9.8 | 97% |
| 2023年8月21日 | Deserialization of Untrusted Data | ColdFusion | 严重 9.8 | 17% |
| 2023年7月20日 | Improper Access Control | ColdFusion | 高 7.5 | 99.8% |
| 2023年7月20日 | Improper Access Control | ColdFusion | 高 7.5 | 99.8% |
| 2023年3月15日 | Deserialization of Untrusted Data | ColdFusion | 高 8.6 | 97% |
来源：Known Exploited Vulnerabilities（CISA，公有领域）、CVE records（cve.org）和 EPSS（FIRST）。受攻击概率是 EPSS 对未来 30 天内有人尝试利用该漏洞的估计。