CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
Published Aug 11, 2010 · updated Oct 2, 2026 · adobe coldfusion
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Timeline
Detection, updates, and resolution for this record.
Aug 11, 2010 · Catalog
Detected
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 2, 2026 · Catalog
Updated
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe adobe/coldfusionversion unspecified
- vendor Adobe ColdFusionversion unspecified
Sources
- CISA KEVCVE-2010-2861
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
cisa.gov - CVE.orgCVE-2010-2861
Official CVE identifier
cve.org - FIRST EPSSCVE-2010-2861
30-day exploitation probability 99.7%
first.org - Exploit Database14641
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database16985
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/http/coldfusion_locale_traversal
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2010-2861
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/inde
nvd.nist.gov