{"id":"CVE-2026-90530","published":"2026-10-13T21:19:57Z","modified":"2026-10-14T15:50:50Z","title":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…","vendor":"Adobe","product":"ColdFusion 2025","tier":"core","eol":null,"description":{"text":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n\n\n\n\n\n\n\n\n\nRDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in the ColdFusion RDS component of Adobe ColdFusion 2025 allows an attacker to read arbitrary files on the file system, reaching sensitive files and directories outside the intended scope. The attacker needs local access to the system with no privileges and no user interaction required, and RDS is disabled automatically when ColdFusion runs in the Production Secure Profile, or can be disabled manually per the Lockdown Guide.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:21:27Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0034,"percentile":0.27436,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad8d3466c8181f05516bab7","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad78144340f998d3db4d0bc","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad62f761b14c745b837b947","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad4ddb44d734735b605dc2f","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad38c34c49c0273168a0f7d","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad23abd6cb9332fcbb88e3b","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ad0e94086fc75fcda994436","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6acf987fa92372976a324f03","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-development-services-rds.html","tags":[]},{"url":"https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/installing-the-server-configuration.html","tags":[]},{"url":"https://helpx.adobe.com/coldfusion/configuring-administering/administering-coldfusion-security.html","tags":[]},{"url":"https://www.adobe.com/cc-shared/assets/pdf/products/coldfusion-family/coldfusion-2025-lockdown-guide-1-1.pdf","tags":[]},{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":[]},{"url":"https://www.stigviewer.com/stigs/adobe_coldfusion/2026-05-13/finding/V-279042","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-100518","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100518","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90530","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.49,"detail":"percentile 0.2744"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-22"}}