CVE Watch1 jul 2026

CVE-2026-48276

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could

CVSS

10.0

Crítico

EPSS

0.9%

p56

KEV

—

Exploit Today

0-100

Publicado: 30 jun 2026 · Última mod.: 1 jul 2026 · CWE-434

EPSS · 30d

0.9%EPSS · 30 días0.9%

2026-07-012026-07-16

Descripción técnica

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Referencias oficiales

helpx.adobe.comhttps://helpx.adobe.com/security/products/coldfusion/apsb26-68.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-562909.8 CRÍ

85.4%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability9d CVE-2026-489089.8 CRÍ

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability9d CVE-2026-489399.8 CRÍ

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2026-562919.8 CRÍ

53.6%

KEV—66Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability6d CVE-2023-388368.8 ALT

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.8d CVE-2023-464747.2 ALT

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.8d