Description
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.
INFO
Published Date :
2025-07-08T20:49:29.949Z
Last Modified :
2025-07-09T16:06:34.728Z
Source :
adobe
AFFECTED PRODUCTS
The following products are affected by CVE-2025-49538 vulnerability.
| Vendors | Products |
|---|---|
| Adobe |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-49538.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact