CVE-2026-105899

{
  "etk_id": "ETK-2026-1515",
  "cve_id": "CVE-2026-105899",
  "display_id": "CVE-2026-105899",
  "ghsa_id": "GHSA-qg77-q924-w96x",
  "euvd_id": "EUVD-2026-100502",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted dangerous-file upload in ColdFusion",
  "summary": "ColdFusion 2023 and ColdFusion 2025 are affected by unsafe handling of dangerous uploaded file types. An unauthenticated remote attacker may be able to run code using the privileges of the ColdFusion process, with no user interaction indicated.",
  "mitigation": "Limit network access to affected ColdFusion deployments and disable or tightly restrict file-upload functionality where feasible. Apply vendor remediation when it becomes available; no fixed release is recorded in the advisory.",
  "vendor": "Adobe",
  "product": "ColdFusion 2025",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2025.0.13"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ColdFusion 2025",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2023.0.25"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ColdFusion 2023",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0055,
  "epss_percentile": 0.4519,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 44.08473515,
  "t0_at": "2026-10-13T20:21:23.594000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T01:14:48.817061+00:00",
      "days": 1.2037641557986112,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T20:21:23.594000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T20:21:23.594000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T20:21:23.594000+00:00",
      "url": "https://github.com/advisories/GHSA-qg77-q924-w96x"
    }
  }
}