Cyber

What changed

Adobe has disclosed a critical vulnerability in ColdFusion that allows for path traversal, which could lead to arbitrary code execution without user interaction. This vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier.

The flaw arises from improper limitations on pathname restrictions, which could be exploited by attackers to manipulate file paths and execute unauthorized commands.

Who is affected

Organizations using Adobe ColdFusion are at risk, particularly those running the affected versions. This vulnerability could have severe implications for data integrity and system security.

The following groups are notably impacted:

• Users of Adobe ColdFusion 2025.9 and 2023.20
• Businesses relying on ColdFusion for web applications
• Developers maintaining ColdFusion applications
• IT security teams managing Adobe products

What to do

It is crucial for affected organizations to assess their ColdFusion installations and apply necessary updates or patches provided by Adobe. Immediate action is recommended to mitigate potential exploitation.

Regularly review security configurations and implement best practices to limit exposure to such vulnerabilities.

• Update ColdFusion to the latest version as soon as possible.
• Conduct a security audit of existing ColdFusion applications.
• Implement monitoring for unusual activity that may indicate exploitation attempts.
• Educate development teams on secure coding practices to prevent similar vulnerabilities.

What changed

The Joomlack Page Builder, specifically versions prior to 3.6.0, has been found to contain an improper access control vulnerability. This flaw allows unauthenticated users to upload files without restriction, which can lead to the execution of arbitrary code on the server.

Who is affected

The vulnerability impacts users of the Joomlack Page Builder extension for Joomla, particularly those running versions below 3.6.0. Organizations utilizing this extension should be aware of the potential risks associated with this flaw.

• Joomla users employing the Page Builder CK extension.
• Websites built on Joomla that have not updated to version 3.6.0 or later.
• Developers and administrators managing Joomla extensions.

What to do

It is crucial for affected users to take immediate action to mitigate the risk posed by this vulnerability. Upgrading to the latest version of the Page Builder CK extension is strongly recommended.

• Update the Page Builder CK extension to version 3.6.0 or later.
• Review server logs for any unauthorized file uploads.
• Implement additional security measures to restrict file uploads and monitor for unusual activity.