CVE-2025-61813HIGH 8.2EPSS p36.7%

CVE-2025-61813CVE-2025-61813

adobe / coldfusion

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the server. Exploitation of this issue does requires user interaction and scope is changed.

Scoring

CVSS 3.18.2 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
EPSS0.47% probability of exploitation · percentile 36.7% · 2026-06-18T12:00:27Z
Published2025-12-10
Last modified2026-06-01

Underlying weaknesses· 1

CWE-611

References

  1. https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html

1

TypeTargetConfidenceTier
WeaknessImproper Restriction of XML External Entity Referencecwe-6110%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-61821
CVE
CVE-2026-47960
CVE
CVE-2025-49535
CVE
CVE-2025-61812
CVE
CVE-2025-61811
CVE
CVE-2025-61809
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.