TLDR Tech / InfoSec
It's 37oC, And All We Can Think About Is ColdFusion
Adobe ColdFusion 2023 and 2025 received a large security update fixing multiple remote file read and write flaws in the RDS FILEIO service, which can lead to unauthenticated remote code execution when RDS is enabled and authentication is off. This post walks through the RDS RPC format, shows how weak path handling allowed arbitrary filesystem access, and explains how new canonical path checks block traversal. It also details unauthenticated file upload and directory listing issues in the CKEditor file manager that run as NT AUTHORITY\SYSTEM when uploads are enabled.
Read the full story