How do I check whether I am affected by CVE-2026-48276?

- Check the installed ColdFusion version and compare it with 2025.9 and 2023.20 (exact build boundaries: unknown) - Confirm whether the ColdFusion server is reachable from the internet (unknown from the sources)

What is the fix for CVE-2026-48276?

- Move ColdFusion to a patched build: unknown, the sources do not name the fixed versions - If behind Cloudflare, set the managed rule 'Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276' to Block (it was Log before the 2026-07-21 release)

Who is not affected by CVE-2026-48276?

Not affected if: not-running-coldfusion.

Live › vulnerability › CVE-2026-48276

Go to dashboard

critical10.0Runtime

Adobe ColdFusion: unauthenticated file upload path traversal lets attackers write files anywhere

Adobe ColdFusion's file upload handling has a path traversal flaw that lets an unauthenticated attacker write or upload files to arbitrary locations outside the designated directories on the server. The sources list versions 2025.9, 2023.20 and earlier as affected, and Cloudflare has deployed a WAF block rule for it.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Jun 30, 2026 UTC
Last modified: Aug 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker writes arbitrary files on the origin server, outside upload directories.
CVSS said: 10.0. The facts above agree.

Who is affected

2 products

Teams running Adobe ColdFusion version 2025.9, 2023.20 or earlier on an origin server are affected, and the sources say the flaw is reachable without authentication. The sources do not describe a non-default configuration requirement, so default installs should be treated as exposed until checked. Teams that do not run ColdFusion can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-48276

Go to dashboard

critical10.0Runtime

Adobe ColdFusion: unauthenticated file upload path traversal lets attackers write files anywhere

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Jun 30, 2026 UTC
Last modified: Aug 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker writes arbitrary files on the origin server, outside upload directories.
CVSS said: 10.0. The facts above agree.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
adobe coldfusion	vendor	= 2023	–
adobe coldfusion	vendor	= 2025	–

Advisory	CVE	Severity	Issue	WAF Coverage
Denial of Service in App Router using Server Actions	CVE-2026-64641	High	Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.	WAF rule Next.js - DoS - CVE-2026-64641 (...90dcdb0a) has been deployed to provide coverage.
Middleware / Proxy bypass in App Router applications using Turbopack and single locale	CVE-2026-64642	High	Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.	This is a middleware bypass that unfortunately cannot be covered through Cloudflare WAF signature engine.
Server-Side Request Forgery in rewrites via attacker-controlled destination hostname	CVE-2026-64645	High	A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.	Existing SSRF rules provide adequate coverage for this vulnerability, no tailored WAF rule was developed.
Server-Side Request Forgery in Server Actions on custom servers	CVE-2026-64649	High	When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.	WAF rule Next.js - SSRF - CVE-2026-64649 (...930091a3) has been deployed to provide coverage.
Denial of Service in the Image Optimization API using SVGs	CVE-2026-64644	Medium	When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.	Malicious request is unfortunately indistinguishable from a legitimate image optimization request, so no WAF rule has been created to address this vulnerability.
Unbounded Server Action payload in Edge runtime	CVE-2026-64646	Medium	A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.	Unfortunately there is no one size fits all rule that can be deployed through WAF in lieu of custom bodySizeLimit configurations, so no WAF rule has been created to address this vulnerability.
Unauthenticated disclosure of internal Server Function endpoints	CVE-2026-64643	Medium	In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.	WAF rule Next.js - Information Disclosure - CVE-2026-64643 (...72952826) has been deployed to provide coverage.
Cache confusion of response bodies for requests with bodies	CVE-2026-64648	Medium	A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the shape fetch(new Request(init), aDifferentInit)	This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.
Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences	CVE-2026-64647	Medium	A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters.	This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

Advisory

CVE

Severity

Issue

WAF Coverage

Denial of Service in App Router using Server Actions

CVE-2026-64641

High

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.

WAF rule Next.js - DoS - CVE-2026-64641 (...90dcdb0a) has been deployed to provide coverage.

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642

High

Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.

This is a middleware bypass that unfortunately cannot be covered through Cloudflare WAF signature engine.

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

CVE-2026-64645

High

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.

Existing SSRF rules provide adequate coverage for this vulnerability, no tailored WAF rule was developed.

Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649

High

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.

WAF rule Next.js - SSRF - CVE-2026-64649 (...930091a3) has been deployed to provide coverage.

Denial of Service in the Image Optimization API using SVGs

CVE-2026-64644

Medium

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.

Malicious request is unfortunately indistinguishable from a legitimate image optimization request, so no WAF rule has been created to address this vulnerability.

Unbounded Server Action payload in Edge runtime

CVE-2026-64646

Medium

A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.

Unfortunately there is no one size fits all rule that can be deployed through WAF in lieu of custom bodySizeLimit configurations, so no WAF rule has been created to address this vulnerability.

Unauthenticated disclosure of internal Server Function endpoints

CVE-2026-64643

Medium

In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.

WAF rule Next.js - Information Disclosure - CVE-2026-64643 (...72952826) has been deployed to provide coverage.

Cache confusion of response bodies for requests with bodies

CVE-2026-64648

Medium

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the shape fetch(new Request(init), aDifferentInit)

This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

CVE-2026-64647

Medium

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters.

This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...215e7d31	N/A	SSRF - Restricted Protocol	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...a935ee5d	N/A	SSRF - Obfuscated Host	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...1b0230ac	N/A	LFI - Path Traversal	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	...61349c8b	N/A	Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276	Log

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...215e7d31

N/A

SSRF - Restricted Protocol

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

...a935ee5d

N/A

SSRF - Obfuscated Host

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

...1b0230ac

N/A

LFI - Path Traversal

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

...61349c8b

N/A

Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276

Log

Adobe ColdFusion: unauthenticated file upload path traversal lets attackers write files anywhere

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Adobe ColdFusion: unauthenticated file upload path traversal lets attackers write files anywhere

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Changelog

WAF Release - 2026-07-21

Sources