CVE-2025-43566

CVE-2025-43566 is an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) in Adobe ColdFusion that allows a crafted pathname to escape restricted directories and read arbitrary files on the server's file system. It is triggered over the network without user interaction, but per the CVSS vector (PR:H) the attacker must already hold high privileges, such as an administrator-level ColdFusion account; the flaw then bypasses ColdFusion's security protections, and the 'scope changed' designation indicates the traversal crosses ColdFusion's security boundary into the underlying system. A successful attacker gains unauthorized read access to arbitrary file system content (high confidentiality impact, no integrity or availability impact), which can expose configuration files, credentials, and other sensitive data. All installations on the ColdFusion 2025, 2023, and 2021 release tracks at or below update levels 2025.1, 2023.13, and 2021.19 respectively are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but its high EPSS score (55.1% probability of exploitation within 30 days, 99th percentile) makes near-term exploitation plausible.

What to do: Upgrade every affected instance to the first update release beyond 2025.1 on the 2025 track, 2023.13 on the 2023 track, and 2021.19 on the 2021 track, per Adobe's security bulletin for this CVE. Because exploitation requires high-privileged access, audit and harden ColdFusion administrator accounts, enforce strong credentials and MFA, and restrict administrative interfaces to trusted networks. Given the elevated EPSS probability, monitor Adobe advisories and threat feeds closely and patch before any public proof-of-concept or in-the-wild exploitation emerges.