CVE-2026-48282: Verified Repro With Script Download

CVE-2026-48282 is an Adobe ColdFusion Remote Development Services (RDS) FILEIO path handling flaw reachable through POST /CFIDE/main/ide.cfm?ACTION=FILEIO. The patched ColdFusion 2025 Update 10 code rejects .. directory-traversal segments, but it still accepts attacker-supplied absolute paths and passes them to the real FILEIO read/write operators. In this run, the target was Adobe ColdFusion 2025 Update 10 with the official Server Auto-Lockdown installer successfully applied. Apache lockdown rules blocked /CFIDE, but the direct ColdFusion Tomcat endpoint remained reachable. When the RDS deployment precondition rds.security.enabled=false was present after lockdown, unauthenticated FILEIO requests read /etc/passwd, wrote a CFML payload into the ColdFusion CFIDE webroot using an absolute path with no .., and executed /usr/bin/id as uid=999(cfuser).

• Package/component affected: Adobe ColdFusion 2025 RDS (coldfusion.rds.RdsFrontEndServlet, coldfusion.rds.FileServlet, coldfusion.rds.RdsFileSecurity) exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO.
• Affected versions: This run validated Adobe ColdFusion 2025 Update 10 (2025,0,10,331899) in Docker image adobecoldfusion/coldfusion2025:2025.0.10, digest/image ID sha256:a51436584affbca07abe4909620cdd098f81737ba1e5f368410633df9474592a. Prior ticket context indicates the original issue affected ColdFusion 2025 Update 9 / 2023 Update 20 and earlier, with partial patch/bypass behavior in later fixed builds.
• Risk level and consequences: Critical when RDS is enabled and RDS authentication is disabled or bypassed/reconfigured. An unauthenticated remote attacker can read arbitrary files, write CFML into a web-executable location, and execute commands as the ColdFusion runtime user. In the locked-down Docker target, the demonstrated runtime user was uid=999(cfuser).

Impact Parity

• Disclosed/claimed maximum impact: Unauthenticated remote code execution through RDS FILEIO path traversal/absolute-path bypass.
• Reproduced impact from this run: Code execution through the real ColdFusion HTTP endpoint after official Server Auto-Lockdown evidence was present. The script wrote a CFML template under /opt/coldfusion/cfusion/wwwroot/CFIDE/ using an absolute path and then executed it over Tomcat, producing PRUVA_LOCKDOWN_RCE_1783451550-154638:uid=999(cfuser) gid=999(cfuser) groups=999(cfuser).
• Parity: full for the tested configuration: CF 2025 Update 10 with Server Auto-Lockdown applied and RDS authentication disabled after lockdown. Apache lockdown blocked /CFIDE, but the direct Tomcat product endpoint remained exploitable.
• Not demonstrated: The proof does not claim that Apache-fronted /CFIDE bypasses the official Apache lockdown rules; the Apache control returned HTTP 404. The proof also does not demonstrate exploitation when rds.security.enabled=true; that negative control correctly returned -100.

Root Cause

The vulnerable path is the RDS FILEIO RPC endpoint. The request body is length-prefixed RDS data where the first FILEIO field is the path and the second field is the operator, such as READ or WRITE. In ColdFusion 2025 Update 10, coldfusion.rds.RdsFileSecurity.resolveCanonical() rejects null/empty paths, null bytes, and path strings containing .. as a traversal segment. The patch path is active, as demonstrated by the ../ negative control returning:

-1:The requested path contains directory traversal sequences and was rejected.
java.io.IOException: The requested path contains directory traversal sequences and was rejected.
    at coldfusion.rds.RdsFileSecurity.resolveCanonical(RdsFileSecurity.java:61)

However, the validation does not enforce that the canonical path remains under an approved RDS root or non-web-executable directory. Absolute paths such as /etc/passwd and /opt/coldfusion/cfusion/wwwroot/CFIDE/<marker>.cfm contain no .. segment, so they pass the traversal check and reach FileServlet$FileReadOperator or FileServlet$FileWriteOperator. When the write target is web-executable, the attacker-controlled CFML runs under the ColdFusion service account.

A fix commit was not available in this Docker-image validation. The effective fix should bind FILEIO operations to an explicit allowed root after canonicalization, reject absolute paths outside that root, and keep RDS disabled/authenticated in production and lockdown profiles.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh from the bundle root, for example:

   PRUVA_ROOT=/path/to/bundle bash bundle/repro/reproduction_steps.sh
   

2. The script:
   • Reuses or starts the real Docker target adobecoldfusion/coldfusion2025:2025.0.10.
   • Verifies the official Server Auto-Lockdown success log in the container.
   • Records product identity, image digest, lockdown installer checksum, Apache lockdown config, and locked-down filesystem permissions.
   • Builds real RDS FILEIO binary payloads.
   • Runs an RDS-authentication negative control (rds.security.enabled=true) and confirms unauthenticated FILEIO returns -100.
   • Re-enables the vulnerable RDS precondition (rds.enabled=true, rds.security.enabled=false) after lockdown.
   • Sends unauthenticated FILEIO requests through the real ColdFusion Tomcat HTTP endpoint to read /etc/passwd, write a CFML marker under CFIDE, and execute it.
   • Confirms Apache /CFIDE remains blocked and that ../ traversal is rejected by the patched path.
3. Expected evidence:
   • /etc/passwd contents in bundle/logs/post_lockdown_abs_read_passwd.log.
   • FILEIO write acknowledgement 1:2:XX in bundle/logs/post_lockdown_abs_write_cfide_webshell.log.
   • RCE marker and uid=999(cfuser) in bundle/logs/post_lockdown_rce_tomcat.log.
   • Apache HTTP 404/403 block in bundle/logs/post_lockdown_apache_cfide_block.log.
   • RdsFileSecurity.resolveCanonical traversal rejection in bundle/logs/post_lockdown_traversal_negative.log.

Evidence

• bundle/logs/product_identity.txt
  • ColdFusion version: 2025,0,10,331899.
  • Base version: 2025,0,0,331385.
  • Docker image/digest: sha256:a51436584affbca07abe4909620cdd098f81737ba1e5f368410633df9474592a.
  • Lockdown installer MD5: a4c76d478c07f91891c89d260c042318.
• bundle/logs/official_lockdown_success.log
  • Contains ColdFusion Server has been locked down successfully! from the official installer run.
• bundle/logs/lockdown_state.txt
  • Shows official Apache lockdown rules including RedirectMatch 404 (?i).*/CFIDE.*.
  • Shows locked-down permissions, including /app as 551 and /opt/coldfusion/cfusion/wwwroot/CFIDE owned by cfuser.
• bundle/logs/post_lockdown_auth_enabled_negative.log
  • Shows the RDS-authentication negative control: -100:Unable to authenticate on RDS server using current security information.
• bundle/logs/post_lockdown_abs_read_passwd.log
  • Shows absolute-path read of /etc/passwd over FILEIO, including root:x:0:0:root:/root:/bin/bash and cfuser:x:999:999::/home/cfuser:/bin/sh.
• bundle/logs/post_lockdown_abs_write_cfide_webshell.log
  • Shows successful FILEIO write acknowledgement: 1:2:XX and HTTP 200.
• bundle/logs/post_lockdown_rce_tomcat.log
  • Shows command execution result: PRUVA_LOCKDOWN_RCE_1783451550-154638:uid=999(cfuser) gid=999(cfuser) groups=999(cfuser).
• bundle/logs/post_lockdown_apache_cfide_block.log
  • Shows Apache-fronted /CFIDE blocked with HTTP 404, confirming the exploit used the direct Tomcat product endpoint rather than bypassing Apache request filtering.
• bundle/logs/post_lockdown_traversal_negative.log
  • Shows ../ traversal rejected by RdsFileSecurity.resolveCanonical, proving the patched traversal filter is active while absolute paths remain accepted.
• bundle/repro/runtime_manifest.json
  • Captures runtime entrypoint, service/healthcheck status, proof artifacts, product version, image ID, lockdown checksum, and exploit marker.

Recommendations / Next Steps

• Enforce canonical-root containment in RdsFileSecurity.resolveCanonical() or immediately after it. Canonicalize the requested path, canonicalize the allowed RDS root, and reject any target not contained within the allowed root.
• Reject absolute paths for RDS FILEIO unless they are explicitly mapped to an approved project/RDS root.
• Ensure Server Auto-Lockdown either disables RDS completely or guarantees RDS authentication cannot be disabled while the server is in a locked-down/production profile.
• Do not expose the internal Tomcat port (8500/8501) on production systems; require all external traffic to traverse the hardened webserver connector or firewall.
• Add regression tests for: absolute /etc/passwd-style reads, absolute webroot writes, ../ traversal, URL/encoding variants, and all deployment modes (Apache connector and direct Tomcat).
• Administrators should upgrade to Adobe's fixed release when available, keep RDS disabled unless strictly required, and audit for unexpected CFML/JSP files under webroots including CFIDE.

Additional Notes

• Idempotency was confirmed: bundle/repro/reproduction_steps.sh ran successfully twice consecutively with fresh per-run markers.
• The proof is product-mode and non-sanitized. It uses real Dockerized Adobe ColdFusion, real Server Auto-Lockdown artifacts, real HTTP requests, and real CFML execution.
• The exploit requires the RDS exposure/precondition (rds.enabled=true and rds.security.enabled=false). With RDS authentication enabled, the same unauthenticated FILEIO request is rejected with -100.
• Apache lockdown remains effective for /CFIDE; the issue shown here is that the direct Tomcat endpoint remains a product HTTP boundary that can still exercise RDS FILEIO under the vulnerable RDS configuration.