UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30289

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue…

Severity
High 8.2
Published
8 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Adobe ColdFusionServers and applications · cpe:a:adobe:coldfusion
  • Version 2025
  • Version 2023-update12
  • Version 2023-update11
  • Version 2023-update10
All 33 release lines
  • Version 2021
  • Version 2021-update1
  • Version 2021-update2
  • Version 2021-update3
  • Version 2021-update4
  • Version 2021-update5
  • Version 2021-update6
  • Version 2021-update7
  • Version 2021-update8
  • Version 2021-update9
  • Version 2021-update10
  • Version 2021-update11
  • Version 2021-update12
  • Version 2021-update13
  • Version 2021-update14
  • Version 2021-update15
  • Version 2021-update16
  • Version 2021-update17
  • Version 2021-update18
  • Version 2023
  • Version 2023-update1
  • Version 2023-update2
  • Version 2023-update3
  • Version 2023-update4
  • Version 2023-update5
  • Version 2023-update6
  • Version 2023-update7
  • Version 2023-update8
  • Version 2023-update9
  • Version 2023-update10
  • Version 2023-update11
  • Version 2023-update12
  • Version 2025

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30289
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30289