Vulnerability Description
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Coldfusion | 2021 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-49538?
CVE-2025-49538 is a vulnerability with a CVSS score of 7.4 (HIGH). ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting c...
How severe is CVE-2025-49538?
CVE-2025-49538 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-49538?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Coldfusion.