CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
CVSS
9.8
Crítico
EPSS
99.7%
p100
KEV
SÍ
25 mar 2022
Exploit Today
80
0-100
Publicado: 11 ago 2010 · Última mod.: 14 ago 2026 · CWE-22
99.7%EPSS · 30 días99.7%
2026-08-022026-08-30
Producto
Adobe / ColdFusion
Vulnerabilidad
Adobe ColdFusion Directory Traversal Vulnerability
Añadido a KEV
25 mar 2022
Remediar antes de
15 abr 2022
Uso conocido en ransomware
Sí
Descripción resumida
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Acción requerida
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2010-2861
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
- securityreason.comhttp://securityreason.com/securityalert/8137
- securityreason.comhttp://securityreason.com/securityalert/8148
- www.adobe.comhttp://www.adobe.com/support/security/bulletins/apsb10-18.html
- www.gnucitizen.orghttp://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
- www.procheckup.comhttp://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
- securityreason.comhttp://securityreason.com/securityalert/8137
- securityreason.comhttp://securityreason.com/securityalert/8148
- www.adobe.comhttp://www.adobe.com/support/security/bulletins/apsb10-18.html
- www.gnucitizen.orghttp://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
- www.procheckup.comhttp://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-82673——
———Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.1hCVE-2026-826035.4 MED—
———A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.2hCVE-2026-825995.4 MED—
———A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.3hCVE-2026-567187.5 ALT—
———AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.7hCVE-2026-826562.6 BAJ—
——0Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.13hCVE-2026-826358.8 ALT—
——0Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.15h