CVE-2026-48282

CRITICAL KEV NUCLEI

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-48282 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 7, 2026. EIP tracks 4 public exploits from researchers including HORKimhab, g0thamRabb1t, imbas007. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository does not contain exploit code or technical analysis for CVE-2026-48282. Instead, it lists external links (including a GitHub repo and an encrypted archive) without providing any functional PoC, root cause details, or patch analysis. The README reads like a placeholder with no depth.

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Exploits (4)

github SUSPICIOUS
by HORKimhab · poc
https://github.com/HORKimhab/poc-cve-collection/tree/main/2026/48xxx/CVE-2026-48282.md

This repository does not contain exploit code or technical analysis for CVE-2026-48282. Instead, it lists external links (including a GitHub repo and an encrypted archive) without providing any functional PoC, root cause details, or patch analysis. The README reads like a placeholder with no depth.

Classification
Suspicious 98%
Attack Type
Other
Complexity
Unknown
Reliability
Unknown
Target: Adobe ColdFusion 2025.9, 2023.20 and earlier
No auth needed
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →
github WRITEUP
by g0thamRabb1t · poc
https://github.com/g0thamRabb1t/cve-2026-48282-coldfusion-rds-detection

This repository provides a detailed technical analysis of CVE-2026-48282, a vulnerability in Adobe ColdFusion Remote Development Services (RDS) that allows arbitrary file write and remote code execution (RCE) via improper authentication and FILEIO operations. The reports document the vulnerability's root cause, exploitation methodology, evidence collection, and detection logic without including functional exploit code.

Classification
Writeup 99%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 2025 Update 9
No auth needed
Prerequisites: RDS enabled with 'No authentication needed' configuration · Access to the RDS endpoint (e.g., /CFIDE/main/ide.cfm?ACTION=FILEIO) · Ability to write to a web-accessible directory
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →
github WORKING POC
by imbas007 · pythonpoc
https://github.com/imbas007/CVE-2026-48282

This exploit targets a path traversal vulnerability (CVE-2026-48282) in Adobe ColdFusion's Remote Development Service (RDS) via the /CFIDE/main/ide.cfm endpoint. It enables unauthenticated arbitrary file read/write, leading to remote code execution by writing a webshell to the webroot.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 2025 <= Update 9, Adobe ColdFusion 2023 <= Update 20
No auth needed
Prerequisites: RDS enabled on the target ColdFusion server · Unauthenticated access to /CFIDE/main/ide.cfm endpoint
mistral-large-3 · analyzed Jul 06, 2026 Full analysis →
vulncheck_xdb WRITEUP
remote
https://github.com/g0thamRabb1t/CVE-2026-48282-coldfusion-rds-detection

This repository provides a detailed technical analysis of CVE-2026-48282, a Remote Development Services (RDS) authentication bypass and arbitrary file write vulnerability in Adobe ColdFusion 2025 Update 9, leading to remote code execution (RCE). The analysis includes evidence collection, detection logic, and mitigation guidance but intentionally omits exploit code.

Classification
Writeup 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe ColdFusion 2025 Update 9
No auth needed
Prerequisites: RDS enabled with 'No authentication needed' configuration · Access to the RDS FILEIO endpoint · Ability to write to a web-accessible directory
mistral-large-3 · analyzed Jul 10, 2026 Full analysis →

Nuclei Templates (1)

Adobe ColdFusion - RDS Arbitrary File Write
CRITICALVERIFIEDby watchtowr,DhiyaneshDk

References (2)

Core 2

Scores

CVSS v3 10.0
EPSS 0.2858
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2026-07-07
VulnCheck KEV 2026-07-02
ENISA EUVD EUVD-2026-40339
CWE
CWE-22
Status published
Products (3)
adobe/coldfusion 2023 (21 CPE variants)
adobe/coldfusion 2025 (10 CPE variants)
Adobe/ColdFusion < 2023.20
Published Jun 30, 2026
KEV Added Jul 07, 2026
Tracked Since Jun 30, 2026