Adobe ColdFusion RDS Path Traversal (CVE-2026-48282)
Description
CVE-2026-48282 is a critical unauthenticated path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS). When RDS is enabled without authentication, the /CFIDE/main/ide.cfm endpoint exposes a file I/O protocol originally designed for Dreamweaver IDE integration. The protocol performs no sandboxing on file paths, allowing remote unauthenticated attackers to read or write arbitrary files on the server filesystem. Affected versions include Adobe ColdFusion 2025 (Update 9 and earlier) and Adobe ColdFusion 2023 (Update 20 and earlier).
Remediation
1. Apply the latest Adobe ColdFusion security update immediately (ColdFusion 2025 Update 10 or later; ColdFusion 2023 Update 21 or later).
2. If RDS is not required in production, disable it in the ColdFusion Administrator under Server Settings → RDS.
3. If RDS must remain enabled, enforce RDS password authentication and restrict /CFIDE/ access to trusted IP ranges at the web server or firewall level.
4. Review server access logs for POST requests to /CFIDE/main/ide.cfm with Content-Type: application/x-ColdFusionIDE, which may indicate prior exploitation attempts.