CVE-2025-54261 is a critical (CVSS 10.0) path traversal flaw in Adobe ColdFusion that could lead to arbitrary code execution. Versions 2025.3, 2023.15, 2021.21 and earlier are affected, and the victim must have optional configurations enabled. Apply the updates in Adobe bulletin APSB25-93.
What's affected
- ColdFusion 2025.3, 2023.15, 2021.21 and earlier are affected, per the record.
- The record says the victim must have optional configurations enabled. It does not say which ones, so read the Adobe bulletin for that detail.
- The record does not name fixed update numbers. Adobe bulletin APSB25-93 is the place to confirm them.
The record lists CVSS 10.0 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Find your ColdFusion update level in the Administrator under the server update or system information page. Compare it with the versions in bulletin APSB25-93.
If you cannot tell whether the optional configurations in the bulletin are enabled, assume they are until you have read it and checked your settings.
What to do now
- Open Adobe bulletin APSB25-93 and identify the fixed update for your ColdFusion line.
- Apply the update on a test server first, then production.
- Check the optional settings the bulletin calls out and turn off any you do not need.
- Make sure the ColdFusion Administrator is not reachable from the internet.
- Review the ColdFusion lockdown guide from Adobe for your version.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. A path traversal lets a request reach files outside the folder the application meant to expose. The record scores impact on confidentiality, integrity and availability as high and marks the scope as changed.
A 10.0 score does not always mean easy. Here the optional configuration requirement narrows the exposed population, but servers that enabled it should treat the update as urgent. The record does not flag the CVE as KEV.
Severity scores are a starting point. The score for this entry is 10.0, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is this exploited in the wild?
The record does not flag it as KEV and the bulletin text in the record says nothing about exploitation.
Why is the score 10.0 if a setting must be enabled?
The score reflects the impact if the condition is met and the changed scope. It does not measure how many servers meet the condition.
Sources
Last reviewed: 18 October 2026.
