---
id: "CVE-2018-15961"
kind: "vulnerability"
aliases: ["CVE-2018-15961"]
title: "Adobe ColdFusion: Adobe ColdFusion Unrestricted File Upload Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.9995
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe ColdFusion", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["coldfusion", "exploited", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2018-09-25T13:29:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15961", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-15961", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15961", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe ColdFusion: Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe ColdFusion has an unrestricted file upload flaw that lets an attacker upload files the server does not check. The sources say this allows code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe ColdFusion affected ? fixed ?

## Fix

Apply the Adobe ColdFusion updates per vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15961
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-15961
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-15961

## From the sources

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_