Advisory · CVE-2026-90530
Path traversal in ColdFusion RDS can read and write the file system
ColdFusion Remote Development Services (RDS) improperly limits pathnames, which Adobe says could lead to arbitrary file system read and write. Adobe rates it CVSS 3.1 9.3.
- Vendor
- Adobe
- Product
- ColdFusion
- Identifier / CWE
- CVE-2026-90530
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A developer convenience service can be walked out of its folder and into the server's file system at large.
- 01Reach RDS
An attacker connects to a ColdFusion server with RDS exposed.
- 02Traversal path supplied
The attacker uses pathnames that escape the restricted directory.
- 03Files read or written
The flaw exposes arbitrary file system read and write in the service context.
What happened
Adobe disclosed CVE-2026-90530 for ColdFusion RDS: an improper limitation of a pathname to a restricted directory (CWE-22) that could lead to arbitrary file system read and write. Adobe’s references include its RDS security guidance and lockdown documentation.
Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.
What to do
- Inventory every ColdFusion deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
- Review application and server logs for RDS connection attempts from unfamiliar hosts, traversal strings in logs, and files read or written outside ColdFusion directories.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
RDS should rarely be enabled in production at all. Update ColdFusion, and take the opportunity to disable RDS where it is not actively needed.