CVE-2025-49545

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

• CWE-918

• https://helpx.adobe.com/security/products/coldfusion/apsb25-69.htmlVendor Advisory

Published

Jul 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4954The Axle Demo Importer WordPress plugin through 1.0.3 does n…8.8
• CVE-2025-49540ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…4.3
• CVE-2025-49541ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…4.3
• CVE-2025-49542ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…5.2
• CVE-2025-49543ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…4.3
• CVE-2025-49544ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…6.8
• CVE-2025-49546ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…2.4
• CVE-2025-49547Adobe Experience Manager versions FP11.4 and earlier are aff…5.4
• CVE-2025-49549Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p1…2.7
• CVE-2025-4955The tarteaucitron.io WordPress plugin before 1.9.5 uses quer…4.7
• CVE-2025-49550Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p1…4.3
• CVE-2025-49551ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are…8.8