CVE-2009-2265

EXPLOITED IN THE WILD

FCKeditor <2.6.4.1 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2009-2265 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 10 public exploits from researchers including Metasploit, Pergyz, zaphoxx, including a Metasploit module exploits/windows/http/coldfusion_fckeditor.

AI-analyzed exploit summary This Metasploit module exploits CVE-2009-2265 in Adobe ColdFusion 8.0.1 by uploading a malicious JSP file via the FCKeditor's file upload functionality, leveraging a directory traversal vulnerability in the 'CurrentFolder' parameter.

Description

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Exploits (10)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappscfm
https://www.exploit-db.com/exploits/16788

This Metasploit module exploits CVE-2009-2265 in Adobe ColdFusion 8.0.1 by uploading a malicious JSP file via the FCKeditor's file upload functionality, leveraging a directory traversal vulnerability in the 'CurrentFolder' parameter.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1
No auth needed
Prerequisites: Network access to the ColdFusion server · FCKeditor component accessible at the default or specified path
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Pergyz · pythonwebappscfm
https://www.exploit-db.com/exploits/50057

This exploit leverages a file upload vulnerability in Adobe ColdFusion 8 to achieve remote command execution by uploading a malicious JSP file. The payload is generated using msfvenom and executed via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8
No auth needed
Prerequisites: Network access to the target server · ColdFusion 8 with vulnerable FCKeditor component
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by zaphoxx · poc
https://github.com/zaphoxx/zaphoxx-coldfusion

This repository contains a functional Python exploit for CVE-2009-2265, an arbitrary file upload vulnerability in Adobe ColdFusion 8.0.1. The exploit uploads a malicious JSP file to the target server via a vulnerable FCKeditor endpoint, allowing remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1
No auth needed
Prerequisites: Target server running ColdFusion 8.0.1 with FCKeditor accessible · Network access to the target · A JSP payload file (e.g., generated via msfvenom)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2009-2265

This repository contains a functional Python script that exploits CVE-2009-2265, an arbitrary file upload vulnerability in ColdFusion 8.0.1. The exploit uploads a malicious JSP file to the target server via a vulnerable FCKeditor endpoint, enabling remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1
No auth needed
Prerequisites: Target server running ColdFusion 8.0.1 with FCKeditor accessible · Network access to the target server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by 0xDTC · remote
https://github.com/0xDTC/Adobe-ColdFusion-8-RCE-CVE-2009-2265

This repository contains a functional exploit for CVE-2009-2265, targeting Adobe ColdFusion 8. The exploit generates a JSP payload using msfvenom, uploads it via a multipart POST request, and triggers it to establish a reverse shell.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8
No auth needed
Prerequisites: msfvenom · curl · Netcat · vulnerable Adobe ColdFusion 8 server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by p1ckzi · client-side
https://github.com/p1ckzi/CVE-2009-2265

The repository contains a functional Python3 exploit script for CVE-2009-2265, which targets an LFI vulnerability in Adobe ColdFusion 8.0.1 via FCKeditor < 2.6.4.1. The script allows arbitrary file upload and execution, with features like accessibility options and post-upload request triggering.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1
No auth needed
Prerequisites: Python3 · requests module · target running Adobe ColdFusion 8.0.1 with FCKeditor < 2.6.4.1
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by matesz44 · remote
https://github.com/matesz44/CVE-2009-2265

This script exploits CVE-2009-2265, an unauthenticated remote code execution vulnerability in Adobe ColdFusion 8. It uploads a malicious JSP file via a directory traversal flaw in the FCKeditor upload component and triggers execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Adobe ColdFusion 8
No auth needed
Prerequisites: curl · msfvenom · uuidgen · tr · network access to target
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by nika0x38 · remote
https://github.com/nika0x38/CVE-2009-2265

This repository contains a functional Rust-based exploit for CVE-2009-2265, targeting Adobe ColdFusion 8's FCKeditor file upload vulnerability via null byte injection to achieve RCE. The PoC generates a JSP reverse shell payload, uploads it using the vulnerability, and triggers execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1 and earlier
No auth needed
Prerequisites: Network access to the target ColdFusion server · A listener set up for the reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC
by dugisan3rd · pythonpoc
https://github.com/dugisan3rd/exploit/tree/main/cve-2009-2265

This repository contains a functional Python exploit for CVE-2009-2265, targeting Adobe ColdFusion 8. The exploit leverages a file upload vulnerability to deploy a JSP reverse shell, achieving remote code execution (RCE).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8
No auth needed
Prerequisites: Target running Adobe ColdFusion 8 · Network access to the target · Python 3 environment · Metasploit Framework (for msfvenom payload generation)
devstral-2 · analyzed Feb 27, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by MC · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/coldfusion_fckeditor.rb

This Metasploit module exploits a file upload vulnerability in Adobe ColdFusion 8.0.1 via FCKeditor's 'CurrentFolder' parameter, allowing arbitrary JSP file upload and execution. It leverages a multipart form data POST request to upload a payload and then triggers it via a GET request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 8.0.1
No auth needed
Prerequisites: Network access to the target ColdFusion server · FCKeditor component accessible at the default or specified path
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (14)

Core 14
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1825
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35909
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1836
Vendor Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35833
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1813
Various Sources mailing-list x_refsource_mlist
http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1022513
Various Sources x_refsource_misc
http://isc.sans.org/diary.html?storyid=6724
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504721/100/0/threaded
Vendor Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html

Scores

EPSS 0.9220
EPSS Percentile 99.7%

Details

VulnCheck KEV 2009-07-05
InTheWild.io 2021-06-24
CWE
CWE-22
Status published
Products (24)
fckeditor/fckeditor 2.0
fckeditor/fckeditor 2.0_fc
fckeditor/fckeditor 2.0_rc2
fckeditor/fckeditor 2.0rc2
fckeditor/fckeditor 2.0rc3
fckeditor/fckeditor 2.1
fckeditor/fckeditor 2.1.1
fckeditor/fckeditor 2.2
fckeditor/fckeditor 2.3 (2 CPE variants)
fckeditor/fckeditor 2.3.1
... and 14 more
Published Jul 05, 2009
Tracked Since Feb 18, 2026