CVE-2026-48282 is a critical arbitrary file write / path traversal vulnerability (CWE-22) in Adobe ColdFusion's RDS (Remote Development Services) FILEIO component, disclosed and patched by Adobe on 2026-06-30 under security bulletin APSB26-68 (which resolved 11 ColdFusion vulnerabilities total, seven rated CVSS 10.0). The RDS protocol communicates over HTTP POST to the endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO using a proprietary length-prefixed field encoding — a 4-byte pad (skipped), a decimal length field, a colon separator, and the raw data payload, repeated per field — that the RdsFrontEndServlet parses and dispatches to action-specific handlers via a command map. RDS clients identify themselves with the User-Agent string "Dreamweaver-RDS-SCM1.00", which is itself a useful network-detection string. The FILEIO handler's WRITE operation performed insufficient validation of attacker-supplied file paths, allowing directory traversal sequences ("../", "..\\") and absolute paths to escape the intended RDS working directory.

A concrete documented WRITE exploitation request is: `POST /CFIDE/main/ide.cfm?ACTION=FILEIO` with `Content-Type: application/octet-stream` and body `4:000043:C:\ColdFusion2025\cfusion\wwwroot\shell.cfm00005:WRITE00001:00000126:<cfexecute name="cmd.exe" arguments="/c whoami & calc" timeout="10" variable="o"></cfexecute>` — writing an executable CFML webshell directly to the web root. The companion read-primitive flaw, CVE-2026-48313, uses the same protocol with a READ action, e.g. `2:000018:C:\Windows\win.ini00004:READ`, and researchers documented attackers using exactly this read of `C:\Windows\win.ini` as a low-risk reconnaissance/verification step to confirm traversal worked before proceeding to the destructive WRITE-based webshell drop.

When RDS is enabled (non-default) with RDS authentication disabled (an unusual but not uncommon misconfiguration, particularly in legacy or lifted-and-shifted deployments), an unauthenticated remote attacker can send the crafted application/octet-stream request specifying an arbitrary destination path and payload content, causing the server to write a new file to that location. Attackers weaponize this by writing a malicious .cfm file containing a <cfexecute> tag, which invokes OS-level binaries (cmd.exe on Windows, /bin/bash via jspawnhelper on Linux) with attacker-controlled arguments. Once written, the webshell is retrieved via a simple HTTP GET request to the newly created file path, executing arbitrary commands in the context of the ColdFusion service account — NT AUTHORITY\SYSTEM by default on Windows installations, or a low-privileged ColdFusion service user (observed as UID 999 / cfuser in one lab validation) on Linux/Unix. A published lab validation (g0thamRabb1t, GitHub) captured the full chain via auditd and tcpdump: a FILEIO WRITE request at 21:14:40.940, an RDS acknowledgement response at 21:14:40.944, a browser GET to the planted `/app/connect.cfm` at 21:14:40.950, and a spawned child process by 21:14:41.321 — a complete write-to-execution window of roughly 40 milliseconds. Post-exploitation, the webshell was used to run discovery commands (whoami, uname, id, pwd) and, in the lab test, to establish an interactive bash reverse shell (`jspawnhelper` → `/bin/bash -c ... ` → `bash -i`) calling back to an attacker-controlled listener on TCP port 4444.

The same underlying RDS FILEIO fix in APSB26-68 also resolved a cluster of related, lower-severity RDS FILEIO issues beyond WRITE and READ: arbitrary file move, arbitrary file delete, and arbitrary directory creation/listing primitives — indicating the FILEIO command dispatcher lacked path canonicalization across all of its file-operation actions. Adobe's fix introduced a new RdsFileSecurity.resolveCanonical() routine enforcing null-byte rejection, traversal-sequence blocking, canonical path resolution, and rejection of client-supplied absolute paths. The same APSB26-68 bulletin separately patched CVE-2026-48276, an unrelated path-traversal flaw in the bundled CKEditor file-manager upload handler (`/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm`) that similarly allows unauthenticated attackers to write files as NT AUTHORITY\SYSTEM via a crafted `path=` multipart parameter containing `../` traversal sequences — a distinct vulnerable component sharing the same disclosure date and root-cause class (missing path canonicalization) as the RDS FILEIO issues, and worth including in the same detection/patch sweep though it is tracked separately from CVE-2026-48282/CVE-2026-48313.

Exploitation follows a four-stage progression documented by researchers: (1) reconnaissance for exposed RDS endpoints via HTTP fingerprinting of /CFIDE/main/ide.cfm and ColdFusion server banners on ports 8500/443, sometimes preceded by a CVE-2026-48313 arbitrary-read verification probe (e.g. reading win.ini); (2) a verification FILEIO WRITE request to confirm arbitrary write capability; (3) webshell deployment — writing a .cfm file containing a <cfexecute>-based command-execution primitive to a web-accessible path, sometimes given an innocuous filename (connect.cfm) to blend in with legitimate application files; and (4) code execution by issuing an HTTP GET to the planted webshell with attacker-supplied command parameters, followed by discovery commands and, in some cases, an interactive reverse shell for further hands-on-keyboard access.

Exploitation began within roughly two hours of Adobe's public disclosure on 2026-06-30, observed via honeypot telemetry (KEVIntel), and was independently corroborated by the Canadian Centre for Cyber Security and the Centre for Cybersecurity Belgium via open-source intelligence. CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-07, issuing a three-day remediation deadline (2026-07-10) for U.S. federal civilian agencies under Binding Operational Directive 26-04, citing active exploitation and that the flaw is trivially automatable and grants total control of the affected asset. Akamai deployed a dedicated App & API Protector rule (ID 3000985 — "Adobe ColdFusion RDS Exploit Attempt Detected (CVE-2026-48282)") for customers, and reports the majority of internet-facing ColdFusion instances (Shadowserver tracked roughly 750-800 internet-exposed ColdFusion hosts at time of disclosure) remain unpatched. No specific threat-actor attribution, campaign name, or targeted-sector data has been published; exploitation to date is characterized as broad and opportunistic against any internet-exposed, misconfigured (RDS-enabled, auth-disabled) instance rather than a targeted campaign. Detection guidance published alongside the lab validation stresses that, in containerized/bind-mounted ColdFusion deployments, monitoring only the container filesystem overlay will miss file-creation evidence — defenders must monitor the real host filesystem path backing any mounted web-root directory.