CVE-2026-90530

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.

• CWE-22

• https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-development-services-rds.html
• https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/installing-the-server-configuration.html
• https://helpx.adobe.com/coldfusion/configuring-administering/administering-coldfusion-security.html
• https://www.adobe.com/cc-shared/assets/pdf/products/coldfusion-family/coldfusion-2025-lockdown-guide-1-1.pdf
• https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
• https://www.stigviewer.com/stigs/adobe_coldfusion/2026-05-13/finding/V-279042

Published

Oct 13, 2026

Last Modified

Oct 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90525A weakness has been identified in itsourcecode Sales and Inv…6.3
• CVE-2026-90526A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-90527A vulnerability was detected in quequnlong shiyi-blog up to …4.3
• CVE-2026-90528A flaw has been found in TDuckApp tduck-platform up to 5.3. …3.5
• CVE-2026-90529A vulnerability has been found in DataEase up to 2.10.25/2.1…3.5
• CVE-2026-9053Mothra would respect a default value given by a website for …6.9
• CVE-2026-90531Adobe Experience Manager is affected by an Improper Restrict…9.6
• CVE-2026-90532Adobe Experience Manager is affected by an Incorrect Authori…10
• CVE-2026-90533Flowise before 3.1.4 contains a broken access control vulner…6.5
• CVE-2026-90534Flowise is a low-code platform for building LLM applications…6.5
• CVE-2026-90535Flowise versions before 3.1.4 contain an unauthenticated den…7.5
• CVE-2026-90536WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…5.3