CVE-2025-61808 CRITICAL

CVE-2025-61808: ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

Vendor Adobe

Product ColdFusion

Weakness CWE-434 · Unrestricted file upload

Published December 9, 2025

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.

Key dates

02Disclosure timeline

December 9, 2025 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-61808 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2022-2418 URVE Web Manager img_upload.php unrestricted upload CVE-2024-31161 ASUS Download Master - Arbitrary File Upload CVE-2024-2125 EnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2024-37179 Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) CVE-2025-7190 code-projects Library Management System student_edit_photo.php unrestricted upload