ColdFusion: path traversal to code execution (CVE-2026-48282)

An attacker can exploit ColdFusion’s path traversal to execute code with the affected process’s privileges without involving a user. CISA lists this vulnerability as exploited.

Public CVE record · Vendor advisory or update instructions · Module source · Source and API bundle

Patch title. ColdFusion Code Execution Path Guard (coldfusion-code-execution-path-guard in the registry). The original source snapshot preserves the source available for the historical report.

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

Synthetic HTTP controls

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/api",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The shared rule scans targets and bodies for selected traversal strings on targets starting with /api or containing /cf.

static MARKS: [&[u8]; 5] = [b"../", b"..%2f", b"%2e%2e", b"/etc/", b"file:"];

Implement the remediation

Vendor update. Identify the installed ColdFusion release line, apply its security update from Adobe, then verify the update number in the ColdFusion Administrator. Adobe lists 2023 Update 21 and 2025 Update 10 for this advisory. Vendor instructions.

The published package uses registry name coldfusion-code-execution-path-guard. Verify its own archive digest before import. Use the fixture API example to reproduce the recorded comparison. It covers the declaration, signed module activation, verification, revocation, and restoration.

Fixture and probes

The benign probe requested a clean user-info endpoint. The marked probe supplied a traversal path through the same endpoint's path parameter. The fixture incremented its marker when a traversal-bearing path reached the handler.

Measured comparison (2026-11-14 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Test scope

The shared rule scans targets and bodies for selected traversal strings on targets starting with /api or containing /cf. The fixture did not run ColdFusion, access files, or execute code.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 5566862d05d5386c70670ff4321bde454888731687fdc50d3b7566a2089eb89e
• Tested binary SHA-256 52ea3f549a90b768e1d655d11b0fd284b00745e7e73636063c323c9adcebbbad
• Activation operation 0dea1fc3-0400-4bb0-9591-e0475c4b391e

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Evidence and artifacts

• Public CVE record
• Published module source
• Source and API bundle