Verified reproduction
CVE-2026-48282: ColdFusion 2025 Lockdown: open-RDS unauth direct-Tomcat absolute-path FILEIO RCE confirmed
CVE-2026-48282 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00262.
Severity CRITICAL
Confidence MEDIUM
Reproduced in 80m 25s
Tool calls 398
Spend $15.29
$
pruva-verify REPRO-2026-00262 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00262/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
Validate the Adobe-reportable ColdFusion 2025 Server Auto-Lockdown chain:
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/logs/lockdown_detail.log0.4 KBbundle/repro/adobe_lockdown_preconditioned_rce.md2.7 KBbundle/logs/adobe_lockdown_rce/proof.log1.1 KBbundle/repro/reproduction_steps.sh20.7 KBbundle/repro/rca_report.md9.7 KBbundle/repro/validation_verdict.json0.8 KBbundle/repro/runtime_manifest.json1.3 KBbundle/logs/bypass_rce_webshell.log0.1 KBbundle/logs/post_lockdown_tomcat.log0.1 KBbundle/logs/post_lockdown_apache.log0.3 KBbundle/repro/adobe_lockdown_unauth_abs_path_chain.md3.4 KBbundle/logs/adobe_lockdown_unauth_abs_path_chain/proof.log2.4 KBbundle/logs/adobe_lockdown_unauth_abs_path_chain/strict_unauth_probe_summary.json0.5 KB