← Back

CVE-2026-48276

nvd nist
Published: Jun 30, 2026Modified: Jul 1, 2026

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 6.0
Source: psirt@adobe.com (Secondary)

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Affected (31)

Products: Adobe: Coldfusion
Adobe
1 product
Coldfusion
Configuration A
31 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Coldfusion
Version 2023
Coldfusion
Version 2023 update10
Coldfusion
Version 2023 update11
Coldfusion
Version 2023 update12
Coldfusion
Version 2023 update13
Coldfusion
Version 2023 update14
Coldfusion
Version 2023 update15
Coldfusion
Version 2023 update16
Coldfusion
Version 2023 update17
Coldfusion
Version 2023 update18
Coldfusion
Version 2023 update19
Coldfusion
Version 2023 update1
Coldfusion
Version 2023 update20
Coldfusion
Version 2023 update2
Coldfusion
Version 2023 update3
Coldfusion
Version 2023 update4
Coldfusion
Version 2023 update5
Coldfusion
Version 2023 update6
Coldfusion
Version 2023 update7
Coldfusion
Version 2023 update8
Coldfusion
Version 2023 update9
Coldfusion
Version 2025
Coldfusion
Version 2025 update1
Coldfusion
Version 2025 update2
Coldfusion
Version 2025 update3
Coldfusion
Version 2025 update4
Coldfusion
Version 2025 update5
Coldfusion
Version 2025 update6
Coldfusion
Version 2025 update7
Coldfusion
Version 2025 update8
Coldfusion
Version 2025 update9

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (1)

Source: psirt@adobe.com
Vendor Advisory

Timeline

No history available yet.