CVE-2010-2861
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Adobe ColdFusion Directory Traversal Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
- CWE
- CWE-22
Affected products
adobe: coldfusion
References
- http://www.adobe.com/support/security/bulletins/apsb10-18.html Not ApplicableVendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb10-18.html Not ApplicableVendor Advisory
- http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/ Exploit
- http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/ Exploit
- http://securityreason.com/securityalert/8137 Broken Link
- http://securityreason.com/securityalert/8148 Broken Link
- http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07 Broken Link
- http://securityreason.com/securityalert/8137 Broken Link
- http://securityreason.com/securityalert/8148 Broken Link
- http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07 Broken Link