Loading
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.
Use CWE-611, Adobe vendor hub and Coldfusion product page to widen CVE-2025-61823 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2026-27304, CVE-2026-27305 and CVE-2026-27306 for nearby disclosures in the same product family.