What is cve-2026-48282?

This repository is a proof of concept tool for CVE-2026-48282, a critical security flaw in Adobe ColdFusion's Remote Development Service. According to the README, the flaw is a path traversal vulnerability with the highest possible severity score, and it lets an attacker who is not even logged in read and write arbitrary files on a vulnerable server through a specific web endpoint, which can lead to full remote code execution. The tool is a Python script meant for security researchers and penetration testers to check whether a ColdFusion server is vulnerable and, if so, demonstrate the impact by reading files from the target system. It can check a single web address for the vulnerability, read a specific file such as system password files on Linux or Windows, or browse a directory listing on the target. There is also a list mode that scans many targets from a text file at once, using multiple threads and saving results to an output file, with an option to automatically try reading a known file on any target found to be vulnerable. The README gives example commands for reading sensitive ColdFusion configuration files, such as the administrator password hash file and a file containing database connection strings, as well as standard Linux system files. Setup is simple: clone the repository and install one Python dependency, the requests library, then run the script with command line flags for the target, the action to take, and optional settings like thread count. This kind of tool is meant for authorized security testing, such as verifying whether your own systems are patched against this CVE, rather than for use against systems you do not have permission to test.