{"id":"CVE-2026-105899","published":"2026-10-13T21:17:29.483","lastModified":"2026-10-14T15:50:50.180","description":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ColdFusion allows unrestricted file uploads with dangerous types, enabling attackers to upload malicious files that can execute arbitrary code in the context of the current user. This represents a critical vulnerability because it can lead to complete system compromise without requiring user interaction.","exploitability":"Exploitation is straightforward and does not require user interaction, making it highly dangerous for vulnerable ColdFusion installations.","blast_radius":"The vulnerability could affect all ColdFusion applications that allow file uploads, potentially leading to widespread arbitrary code execution across affected systems.","remediation":"No fixed version information provided in the description; disable file upload functionality or restrict access to affected endpoints until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:45:08.228Z"}}