{"id":"CVE-2026-105899","published":"2026-10-13T21:17:29Z","modified":"2026-10-20T00:12:45Z","title":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…","vendor":"Adobe","product":"ColdFusion 2025","tier":"core","eol":null,"description":{"text":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe ColdFusion 2025 contains an unrestricted file upload flaw (classified as unrestricted upload of a file with a dangerous type) in its file handling. An attacker who can reach the affected component over the network, with no privileges and no user interaction, can upload a dangerous file type and achieve arbitrary code execution in the context of the current user, with scope changed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:59Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01044,"percentile":0.64062,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad8d3466c8181f05516bab7","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad78144340f998d3db4d0bc","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad62f761b14c745b837b947","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad4ddb44d734735b605dc2f","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad38c34c49c0273168a0f7d","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad23abd6cb9332fcbb88e3b","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ad0e94086fc75fcda994436","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6acf987fa92372976a324f03","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-100502","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100502","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105899","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":22.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.81,"detail":"percentile 0.6406"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-434"}}