CVE-2026-90530

Summary

ColdFusion RDS allows path traversal attacks that let attackers read arbitrary files outside the intended directory scope, potentially exposing sensitive data. This is critical because RDS is a development debugging feature that should be disabled in production environments.

Exploitability

Exploitation is straightforward with no user interaction required, but depends on RDS being enabled on a ColdFusion server that isn't configured in Production Secure Profile mode.

Blast radius

The impact could include exposure of configuration files, source code, database credentials, and other sensitive artifacts from the ColdFusion server's file system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable RDS immediately on all ColdFusion servers or upgrade to version 2023.0.15 or later which includes RDS lockdown improvements.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.