imbas007/CVE-2026-48282

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-48282, an unauthenticated path traversal in Adobe ColdFusion RDS. It reads/writes arbitrary files via /CFIDE/main/ide.cfm and achieves RCE by deploying a CFML webshell or executing commands.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that exploits CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion RDS. It reads/writes files and deploys a CFML webshell for command execution, all consistent with the stated exploit behavior. No concealed backdoor, deceptive payload, or unrelated harmful action was observed in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareAdobe ColdFusion
Attack typespath traversalremote code executionarbitrary file readarbitrary file write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-48282 by reading/writing files and executing commands on a vulnerable target. It includes RDS protocol encoding, path traversal payloads, webshell generation, and command execution logic, which goes beyond detection or scanning.

CVE-2026-48282.py:1-22CVE-2026-48282.py:273-435

Requirements

  • Target must have Adobe ColdFusion RDS enabled and accessible without authentication.CVE-2026-48282.py:7-10
  • Target must be running a vulnerable ColdFusion version (2025 <= Update 9, 2023 <= Update 20).CVE-2026-48282.py:12-14

Observed behavior

  • Sends crafted RDS protocol requests to /CFIDE/main/ide.cfm to read arbitrary files from the target filesystem.CVE-2026-48282.py:273-289
  • Writes arbitrary files to the target filesystem via the RDS endpoint, enabling webshell deployment.CVE-2026-48282.py:291-301
  • Deploys a CFML webshell to the ColdFusion web root to achieve remote command execution.CVE-2026-48282.py:376-401
  • Executes arbitrary system commands by writing a temporary CFML file and requesting it via HTTP.CVE-2026-48282.py:404-435
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Arbitrary file read via RDS path traversalThe script constructs RDS READ requests with traversal prefixes to read files like /etc/passwd or win.ini, matching the CVE description.CVE-2026-48282.py:113-115CVE-2026-48282.py:258-269
Exploit Behavior
Arbitrary file write via RDS path traversalThe script constructs RDS WRITE requests to deploy a webshell or temporary command execution file, consistent with the CVE's RCE impact.CVE-2026-48282.py:118-120CVE-2026-48282.py:376-401
Exploit Behavior
CFML webshell deployment for command executionThe script generates and writes a CFML webshell that executes system commands via <cfexecute>, which is the intended RCE mechanism.CVE-2026-48282.py:351-373CVE-2026-48282.py:404-435
Network Target
Adobe ColdFusion RDS endpoint /CFIDE/main/ide.cfmThe script targets the specific vulnerable endpoint described in the CVE.CVE-2026-48282.py:46-48
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no binary or opaque content was present. The artifact was not executed, and its effectiveness or safety is not verified.
  • Only the three text files (Python script, README, requirements) were reviewed; no binary files were present or analyzed.
  • The review does not verify that the script functions as claimed or is safe to execute; it only assesses the supplied evidence for backdoor indicators.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1