VulnerabilityAnalyzed

CVE-2025-61823

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read.

MEDIUM 6.2EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.

CVSS 3.1: 6.2 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: adobe/coldfusion
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/coldfusion/apsb25-105.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.