CVE-2025-43566: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue does not require user interaction and scope is changed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43566?
CVE-2025-43566 is classified as a high-severity vulnerability due to its potential for arbitrary file system access.
How do I fix CVE-2025-43566?
To mitigate CVE-2025-43566, update Adobe ColdFusion to the latest version provided by Adobe.
What versions of ColdFusion are affected by CVE-2025-43566?
CVE-2025-43566 affects ColdFusion versions 2025.1, 2023.13, and 2021.19 and earlier.
What type of vulnerability is CVE-2025-43566?
CVE-2025-43566 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, commonly known as a Path Traversal vulnerability.
What could an attacker achieve by exploiting CVE-2025-43566?
An attacker exploiting CVE-2025-43566 could gain unauthorized access to sensitive files on the server.