---
id: "CVE-2010-2861"
kind: "vulnerability"
aliases: ["CVE-2010-2861"]
title: "Adobe ColdFusion: Adobe ColdFusion Directory Traversal Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99747
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe ColdFusion", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe", "coldfusion", "exploited", "ransomware", "runtime", "self-hosted"]
not_affected_if: ["administrator-console-not-exposed", "not-coldfusion"]
published_at: "2010-08-11T18:47:51+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2861", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-2861", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2861", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe ColdFusion: Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion's administrator console has a directory traversal flaw that lets remote attackers read arbitrary files on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog and is used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe ColdFusion affected ? fixed ?

## Fix

Apply the Adobe ColdFusion updates per vendor instructions; the specific fixed version is unknown from these sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2861
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-2861
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-2861

## From the sources

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_