ColdFusion XXE Bypass

ColdFusion is a server-side scripting and application development platform. This vulnerability allows attackers to bypass security restrictions on XML external entity references ('XXE'), potentially leading to arbitrary file system reads. A successful exploit could grant access to sensitive files and data on the server.

Affected versions: 2021.22 If you don't recognise this software, you're probably not affected.

To fix this vulnerability:

1. Upgrade to ColdFusion 2025.4 or later.
   • Download from: https://www.adobe.com/support/coldfusion.html
2. Immediate mitigations:
   • Restrict network access to your ColdFusion instance (firewall it from the public internet)
   • Audit admin account activity for suspicious access patterns
   • Monitor for unauthorized token creation

• Vendor Advisory