cbcvebase.
CVE-2025-54234
published 2025-08-18

CVE-2025-54234: ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file…

PriorityP414low2.7CVSS 3.1
AVNACLPRHUINSUCLINAN
EPSS
0.77%
51.8th percentile
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobecoldfusion<= 2021.19—
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.