CVE-2026-105899

Summary

ColdFusion allows unrestricted file uploads with dangerous types, enabling attackers to upload malicious files that can execute arbitrary code in the context of the current user. This represents a critical vulnerability because it can lead to complete system compromise without requiring user interaction.

Exploitability

Exploitation is straightforward and does not require user interaction, making it highly dangerous for vulnerable ColdFusion installations.

Blast radius

The vulnerability could affect all ColdFusion applications that allow file uploads, potentially leading to widespread arbitrary code execution across affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version information provided in the description; disable file upload functionality or restrict access to affected endpoints until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.