# CVE-2010-2861

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

- Page: https://www.vulneraibility.com/cve/CVE-2010-2861
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15; known ransomware use
- EPSS: 99.75% (percentile 100.0)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module · 2 GitHub proofs of concept · 1 Nuclei template (first 2010-08-14)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2026-08-14)
- Weakness: CWE-22
- Published: 2010-08-11

## Affected

- adobe:coldfusion

## References

- [other] http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
- [other] http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
- [other] http://www.adobe.com/support/security/bulletins/apsb10-18.html
- [advisory] http://securityreason.com/securityalert/8137
- [advisory] http://securityreason.com/securityalert/8148
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.