CVE-2025-24446: ColdFusion | Improper Input Validation (CWE-20)
Published Apr 8, 2025
·Updated
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed.
Affected Software
34 affected components
Adobe ColdFusion<=2023.12, <=2021.18, <=2025.0
Adobe ColdFusion=2021
Adobe ColdFusion=2021-update1
Adobe ColdFusion=2021-update10
Adobe ColdFusion=2021-update11
Adobe ColdFusion=2021-update12
Adobe ColdFusion=2021-update13
Adobe ColdFusion=2021-update14
Adobe ColdFusion=2021-update15
Adobe ColdFusion=2021-update16
Adobe ColdFusion=2021-update17
Adobe ColdFusion=2021-update18
Adobe ColdFusion=2021-update2
Adobe ColdFusion=2021-update3
Adobe ColdFusion=2021-update4
Adobe ColdFusion=2021-update5
Adobe ColdFusion=2021-update6
Adobe ColdFusion=2021-update7
Adobe ColdFusion=2021-update8
Adobe ColdFusion=2021-update9
Adobe ColdFusion=2023
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025
Event History
Apr 8, 2025
CVE Published
via MITRE·08:02 PM
Data Sourced
via MITRE·08:02 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-24446?
CVE-2025-24446 has a high severity rating due to its potential to allow arbitrary code execution.
2
How do I fix CVE-2025-24446?
To fix CVE-2025-24446, update Adobe ColdFusion to version 2023.12, 2021.18, or 2025.0 or later.
3
What versions of ColdFusion are affected by CVE-2025-24446?
CVE-2025-24446 affects Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier.
4
What type of vulnerability is CVE-2025-24446?
CVE-2025-24446 is classified as an Improper Input Validation vulnerability.
5
What are the consequences of exploiting CVE-2025-24446?
Exploitation of CVE-2025-24446 can lead to arbitrary code execution in the context of the current user.