CVE-2025-61813
published 2025-12-10CVE-2025-61813: ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that…
PriorityP344high7.4CVSS 3.1
AVNACLPRNUIRSCCHINAN
EPSS
0.55%
45.2th percentile
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the server. Exploitation of this issue does requires user interaction and scope is changed.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | coldfusion | <= 2025.4 | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe ColdFusion up to 2021.22/2023.16/2025.4 xml external entity reference (apsb25-105 / CNNVD-202512-1750)
vuldb·2026-09-29·CVSS 7.4
CVE-2025-61813 [HIGH] Adobe ColdFusion up to 2021.22/2023.16/2025.4 xml external entity reference (apsb25-105 / CNNVD-202512-1750)
A vulnerability was found in Adobe ColdFusion up to 2021.22/2023.16/2025.4. It has been declared as problematic. The affected element is an unknown function. Executing a manipulation can lead to xml external entity reference.
This vulnerability is tracked as CVE-2025-61813. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
GHSA-x7fx-4pm8-g98w: ColdFusion versions 2025
ghsa_unreviewed·2025-12-10
CVE-2025-61813 [HIGH] CWE-611 GHSA-x7fx-4pm8-g98w: ColdFusion versions 2025
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the server. Exploitation of this issue does not require user interaction and scope is changed.
No detection rules found.
No public exploits indexed.
2025-12-10
Published