Inside CVE-2026-48282: ColdFusion's RDS path traversal to RCE

Adobe's 30 June 2026 ColdFusion update fixed a maximum-severity flaw in a feature many administrators had forgotten was still switched on: Remote Development Services (RDS), the Dreamweaver-era protocol that lets an IDE read and write files on a running ColdFusion server. CVE-2026-48282 scores a full CVSS 10.0. It needs no authentication, no user interaction and no local access, only a single HTTP POST to a legacy endpoint most teams have never audited.

The bug is a textbook CWE-22 path traversal, but the blast radius is unusually direct: RDS's file-write primitive lets an attacker drop a CFML file anywhere ColdFusion can write, including the web root. From there, the file executes as ColdFusion itself the moment it is requested over HTTP. Adobe's advisory that day, APSB26-68, patched several other ColdFusion vulnerabilities alongside it, including a related arbitrary file-read flaw in the same RDS handler (CVE-2026-48313) and a separate upload path-traversal issue in the CKEditor integration (CVE-2026-48276).

Within days of the patch, researchers published a diff analysis, and proof-of-concept exploitation followed almost immediately. CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog on 7 July 2026, with a remediation deadline of 10 July. For appsec engineers and SOC analysts running ColdFusion anywhere in the estate, this is a stop-everything patch, not a backlog item.

Anatomy of the RDS FILEIO handler

RDS speaks a length-prefixed binary protocol to the servlet behind /CFIDE/main/ide.cfm?ACTION=FILEIO: each field carries a 4-byte pad, a decimal length, a colon, then raw data. A WRITE action passes a filename straight to the underlying FileServlet, which resolved it with getFile(filename) and nothing else, no canonicalisation, no check against a root directory, and no filtering of ../ sequences.

POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1
Host: cf.lab.example
User-Agent: Dreamweaver-RDS-SCM1.00
Content-Type: application/x-ColdFusionIDE

0004:000043:C:\ColdFusion2025\cfusion\wwwroot\shell.cfm
0005:WRITE0001:00000126:<cfexecute name="cmd.exe" arguments="/c whoami">

Adobe's fix adds RdsFileSecurity.resolveCanonical() ahead of every RDS file operation. The function canonicalises the requested path, rejects absolute paths and null bytes, and confirms the result still sits inside the RDS-allowed root before FileServlet ever touches disk. Until that check runs, any RDS write is trusted.

A textbook CWE-22 flaw, at CVSS 10.0

MITRE's CWE-22 entry describes this exact failure mode, an external value shaping a path that should never leave its sandbox:

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory… CWE-22 (Path Traversal), MITRE

CVE-2026-48282 is that definition executed literally. The 'restricted parent directory' is the RDS scratch area; the 'external input' is the filename field inside the FILEIO request; the missing neutralisation is exactly what resolveCanonical() now performs. The S:C in the CVSS vector reflects the scope change: a flaw confined to the RDS servlet ends in code execution under the whole ColdFusion service account, not just the servlet's own sandbox.

Affected and patched versions

Both supported ColdFusion branches carry the flaw; only the RDS servlet code differs by version.

Version alone will not tell you whether RDS is reachable. RDS ships disabled by default on new installs since ColdFusion 2018, but is commonly left on in development, staging, and production servers that were upgraded in place, precisely the instances least likely to appear in an asset inventory.

Indicators of compromise

Because the write primitive lands a file before any code runs, the strongest signal is the write itself, not the eventual webshell request.

None of these are unique to this CVE, RDS abuse and web-root file drops are an old ColdFusion attack pattern, but an ACTION=FILEIO request followed within seconds by a new .cfm file and a spawned shell is close to definitive.

A safe way to check exposure

A detection script for this CVE should answer one question, is RDS reachable and is the version vulnerable, without ever calling the FILEIO write path itself. The check below does three things: it fingerprints the ColdFusion version from the administrator login page, confirms whether the RDS endpoint responds at all, and compares the reported build against the patched update numbers. It performs no write, so running it against a production host carries no more risk than a version scan.

#!/usr/bin/env python3
"""Exposure check for CVE-2026-48282 (Adobe ColdFusion RDS path traversal).
Read-only: fingerprints the CF version and probes RDS reachability.
Does not call ACTION=FILEIO and never writes to the target."""
import re
import sys
import requests

FIXED = {"2025": 10, "2023": 21}
VERSION_RE = re.compile(r"ColdFusion\s?(20\d{2})\D+?(\d+)")

def check(base_url: str, timeout: float = 8.0) -> None:
    s = requests.Session()
    s.verify = True

    admin = s.get(f"{base_url}/CFIDE/administrator/index.cfm",
                   timeout=timeout, allow_redirects=True)
    m = VERSION_RE.search(admin.text)
    if m:
        branch, update = m.group(1), int(m.group(2))
        fixed = FIXED.get(branch)
        status = "VULNERABLE" if fixed and update < fixed else "patched/unknown"
        print(f"[version] ColdFusion {branch} Update {update} -> {status}")
    else:
        print("[version] not disclosed on the admin login page")

    rds = s.get(f"{base_url}/CFIDE/main/ide.cfm", params={"ACTION": "PING"},
                timeout=timeout, allow_redirects=False)
    reachable = rds.status_code not in (404,)
    print(f"[rds] /CFIDE/main/ide.cfm ACTION=PING -> HTTP {rds.status_code} "
          f"({'reachable, investigate further' if reachable else 'not exposed'})")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        sys.exit("usage: check_cve_2026_48282.py https://cf.example.internal")
    check(sys.argv[1].rstrip("/"))

Treat any 'reachable' result as a finding on its own, RDS should not answer at all on a production listener. A vulnerable version plus a reachable RDS endpoint is a confirm-and-patch-now case; escalate to full incident response if the IOCs from the previous section also show up in access logs.

Immediate actions for SOC and appsec teams

Patching removes the flaw; the rest of this list closes the exposure window and confirms nothing already used it.

None of this substitutes for the update. A path traversal that reaches unauthenticated RCE at CVSS 10.0, already in CISA's KEV catalog, is not a risk to manage around, it is a patch to ship today.