CVE-2025-61823

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.

• CWE-611

• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.htmlVendor Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61818InCopy versions 20.5, 19.5.5 and earlier are affected by a U…7.8
• CVE-2025-61819Photoshop Desktop versions 26.8.1 and earlier are affected b…7.8
• CVE-2025-6182The StrongDM Windows service incorrectly handled communicati…8.5
• CVE-2025-61820Illustrator versions 28.7.10, 29.8.2 and earlier are affecte…7.8
• CVE-2025-61821ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…6.8
• CVE-2025-61822ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are…6.2
• CVE-2025-61824InDesign Desktop versions 20.5, 19.5.5 and earlier are affec…7.8
• CVE-2025-61826Illustrator on iPad versions 3.0.9 and earlier are affected …7.8
• CVE-2025-61827Illustrator on iPad versions 3.0.9 and earlier are affected …7.8
• CVE-2025-61828Illustrator on iPad versions 3.0.9 and earlier are affected …7.8
• CVE-2025-61829Illustrator on iPad versions 3.0.9 and earlier are affected …7.8
• CVE-2025-6183The StrongDM macOS client incorrectly processed JSON-formatt…7