---
id: "CVE-2013-0629"
kind: "vulnerability"
aliases: ["CVE-2013-0629"]
title: "Adobe ColdFusion: Adobe ColdFusion Directory Traversal Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.65795
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe ColdFusion", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe", "coldfusion", "exploited", "runtime", "self-hosted"]
not_affected_if: ["not-coldfusion"]
published_at: "2013-01-09T01:55:03+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0629", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-0629", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0629", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe ColdFusion: Adobe ColdFusion Directory Traversal Vulnerability

Adobe ColdFusion has a directory traversal flaw that lets an unauthorized user reach restricted directories on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe ColdFusion affected ? fixed ?

## Fix

Apply the updates per Adobe's vendor instructions; the specific fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0629
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-0629
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-0629

## From the sources

Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_