VIR Vulnerability Intelligence Relay

CVE-2025-61813

high
Published 2025-12-10 · Modified 2026-04-28
CVSS v3
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v2
—
VIR risk
8.6

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the server. Exploitation of this issue does requires user interaction and scope is changed.

Predictions

Exploit likelihood
91%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@adobe.com — https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html

Application impact
VendorProductVersionsFixed
adobe adobecoldfusion2021
adobe adobecoldfusion2023
adobe adobecoldfusion2025

References

CWEs

CWE-611

Verify integrity in audit chain (admin only). AS-IS.