ColdFusion

Hello,We are migrating Coldfusion from Centos 7.8 [CF2021] to Ubuntu 22.24 [CF2023].I was wondering what are the best methods to export $CF_2021_DIR/jre/lib/security/cacerts and import them to the new server?Is it the via scripts or can just cacerts file be copied over?What is the recommeded way if any? ThanksDejan

Hi, we are looking into better XSS (Cross-site scripting) prevention.We have the "Enable Global Script" protection checked in CFAdminWe have modified neo-security.xml to include a regex to remove various unwanted tagsWe have queryparamed all querysWe are using getSafeHTML() when neededWe are about to go in block mode behind a WAF Does anyone have other recommendations? I couldn't find any recent posts about this in these forums. 

Hello all, I'm currently working on a project using ColdFusion 2023, and I need to programmatically apply Sensitivity Labels to Word and Excel files. I'm not sure how to do this, and I also don't know if ColdFusion have any native integration with the Microsoft Information Protection SDK. My goal is to automate the labeling process for Office documents generated or managed by my ColdFusion application.Here are my questions:Has anyone successfully applied sensitivity labels to Office files using ColdFusion?Are there recommended approaches or best practices for integrating ColdFusion with Microsoft Graph API for this purpose?Is there any Adobe tooling or ColdFusion-native support planned for Microsoft Information Protection? Any guidance, examples, or documentation links would be greatly appreciated!Thanks 

On Thursday, the error below began appearing after the last 2023 coldfusion update on my cfindex code that is atleast 10 years old. I found removing the .dot file extension from my extensions list stopped the error from occurring. However, .docx files will not index now. I tried to uninstall the update 15, although this did not solve the error or the indexing issue  Messagecom.zaxxer.sparsebits.SparseBitSet not found by poi-5.4.1 [36]StackTracejava.lang.ClassNotFoundException: com.zaxxer.sparsebits.SparseBitSet not found by poi-5.4.1 [36] at org.apache.poi.xslf.usermodel.XSLFSheet.<init>(XSLFSheet.java:89) at org.apache.poi.xslf.usermodel.XSLFSlideMaster.<init>(XSLFSlideMaster.java:64) at org.apache.poi.ooxml.POIXMLFactory.createDocumentPart(POIXMLFactory.java:61) at org.apache.poi.ooxml.POIXMLDocumentPart.read(POIXMLDocumentPart.java:671) at org.apache.poi.ooxml.POIXMLDocument.load(POIXMLDocument.java:165) at org.apache.poi.xslf.usermodel.XMLSlideShow.<in

Hi everyone,I’m working on a small food-related project in ColdFusion where I need to pull menu data from an XML feed. The feed has both restaurant names and menu items mixed into one "keywords" field.Here’s a simplified version of the XML:<cfxml variable="menu"><catalog><food id="cs101"><author>Chicken</author><keywords>Chicken Salad Chick, Classic Carol, Lauryn’s Lemon Basil, Cranberry Kelli</keywords></food><food id="cs102"><author>Deli</author><keywords>Subway, Italian BMT, Turkey Breast, Tuna, Veggie Delight</keywords></food></catalog></cfxml>What I’d like to do is just display the restaurant name (always the first value in the keyword string) and ignore the rest.Desired Output:Chicken Salad ChickSubwayFor context, the real data comes from a food blog project I’m building: https://chickensaladchicksmenu.comAny help or code snippet would be awesome 🙏

Our internal vulnerability accessment tool has identified a sever threat (Malware alert) in the coldfusion installation path. We are getting frequent alerts. Just need help from the forum to fix this issue.  • Threat: Backdoor:PHP/Dirtelt• Microsoft Defender Antivirus event code: 1116• Correlation ID: {64391B54-9146-4EF3-A8A5-EF12C4B48492}• Threat outcome: The operation completed successfully.• Microsoft action: Windows Defender: Antimalware platform detected potentially unwanted software ()• Message: "Microsoft Defender Antivirus has detected malware or other potentially unwanted software."• Filepath: :\\COLDFUSION2021\\cfusion\\runtime\\work\\Catalina\\localhost\\tmp\\neotmp10322993890733267903.tmp;file:_Drive path:\\COLDFUSION2021\\cfusion\\runtime\\work\\Catalina\\localhost\\tmp\\neotmp11307734161545627760.tmp;file:_Drive path:\\COLDFUSION2021\\cfusion\\runtime\\work\\Catalina\\localhost\\tmp\\neotmp12158617298315559136.tmp;file:_Drive path:\\COLDFUSION2021\\cfu

I was notified by Cybersource, that they are upgrading and I am required to use the P12 certificate for Authentication with my SOAP API application that has been running for years with Cybersource.I'm using the CFHTTP and added the additional variables to include the P12 cert for Authentication, but I'm receiving an error that HmacPBESHA256 is Not Available.After some research, apperantly CF2021 and its Java JDK Version is 11.0.11 and does not support this agorithum. So, I tried to update the JDK version to 11.0.24, which is listed on Adobes website as being compatabile with CF21. I also updated the jvm.config file to point to the new Home directory for 11.0.24.Now, the CF Application service will not start.I'm hoping someone can provide me some much appreciated help. Thank you!Michael

I am trying to get the PDF manager to work on coldfusion 2025 (developer addition) running on Ubuntu with Apache web server. I did the full GUI install (ColdFusion_2025_GUI_WWEJ_linux64.bin ) select developer addition, all add ons etc. Did no install the separate addons download. So jetty is instslled under cfusion.After installation I can verify the PDF  Manager ( in my case the install changed the port to 8999). Like some other post I have seen I was seeing the unregistered in the log. Selecting edit and saving without any changes allowed me to verify and provided the reghistered log item:May 2, 2025 07:15:06 AM Information [http-nio-8500-exec-4] - PDFg service manager http://127.0.0.1:8997/PDFgServlet/ unregistered.May 2, 2025 07:15:06 AM Information [http-nio-8500-exec-4] - PDFg service manager http://127.0.0.1:8997/PDFgServlet/ registered.I do have it connected to appache anbd the web root is set so in a file called test.cfm I have:<cfhtmltopdf><h1>Hello World<

I have created 2 Javascripts to visualize and hid specific fields. These fields have the properties "hidden" When activating the Java script these fileds become visible, exactly how it should. But when de-activing  a Java script the properties of these fields changes from "hidden" to "visible"  Is this a known issue? Or is there somebody how knows how to deal with this

Team, I understand new install will go separate drive/folder etc.  Also will need run seperate website due to Connector separate instance etc. I know i can share same JDK installation. My question is not clear when documentation says to remove older connector?Shouldn't/I need new connector configured for new website/CF instance? ty  Jose DuenasLead System Admin

I'm using Cold Fusion 2016. I know the ODBC DSN works because I can use Excel to connect to the same AS400 DSN using it.As you can see in the screen shot I can also connect via the C:\ColdFusion2016\cfusion\db\slserver54\tools\ivcheckodbc.exe utility.I've tried restarting, rebooting etc etc.Any ideas? 

Without going into to much detail, we basically have 0 control over anything at my company. So we're resigned to doing manual Coldfusion 2023 updates on our developement machines. On our actual servers we can use the adobe update site.Manual updates seem to have a lot of quirks, so it would be ideal to use the Administrator. Is there a way to point the Update Site URL to a folder to look for updates? It doesn't seem to accept a folder path unlike the Packages Site URL. That still might not work anyway because we don't have local admin access 🙂 Trying to install update 15 through our SCCM we got a bunch of these errors: Exception : Illegal character in opaque part at index 2: C:\ColdFusion2023\bundles\repo/ib6coreutil-1.3.jarI've managed to downgrade myself manually to update 13 but now we're getting the mail error and no amount of felix cache clearing is fixing it. I've also tried setting up the proxy under Package Manager but the error isn't super helpful: 

Initial Assumptions and Red HerringsThe issue began when an application running on ColdFusion 2023 appeared to stop responding. All signs initially pointed to a .NET or database connection issue. This assumption was made based on the browser developer tools, which showed a generic HTTP 500 Internal Server Error, and a complete lack of entries in the event logs. It looked like the application wasn't even starting.Still operating under the .NET assumption, I struggled to gather useful logs. The Failed Request Tracing logs were not showing any information, which I later traced back to missing folder permissions. Once those were corrected, the logs began to populate.Because the failed request log showed a warning related to isapi_redirect.dll, and the ColdFusion page had no logic in it, I changed the file extension from .cfm to .htm to test if the problem was related to ColdFusion execution. Surprisingly, the page loaded correctly, reinforcing the theory.With logs in hand, I saw warnings r

CF 2021 Windows SErver 2022 -- My setting is curring 20 MB i can not change it - i can noty even lower it if i try i get a message that says in admin Important notice about last submissions... BUT it does not give me any notice. If i try to even change 20MB and lower it i get that message. I need to raise this limit. what is the problem?

Hello all,With Code Analyzer scanning our files.  With all it fines.  Is there a way to export all that is found?So you don't have to go one by one through each finding.Thank you.

I have had a nightmare trying for two weeks to get CF2025 installed on a brand new linux server.  I spent 2.5 hours on a call with CFSupport and they could not help me, and in fact made it worse. This has been the worst experience, and I do not think I could ever recommend ColdFusion to anyone despite having used it for nearly 30 years. I don't know where to turn since Adobe themseslves were not able to get it successfully intalled and working as it should be.   I guess I am posting out of sheer frustration and shock at how hard this has been. Also, the documentation for linux installation is absolutely terrible and still has references to older versions and inaccuracies and ommitted steps. I don't know why the ColdFusion team does not care about making installation something that acheivable without knowing lots of obscure and arcane settings.  There are too many moving parts without any clear documenation or trouble shooting guides that are helpful.&

How do I go about updating my cold fusion installtion from CF2021 to the latest version if I have purchased through AWS Marketplace?

I'm trying to increase the Maximum number of POST request parameters field in the CF Administrator console above 100 to accomodate a legacy app that can have over 100 form fields.  The developer edition will let me set any value I want.  The standard edition gives me an error: when I try to increase the POST request parameters above 100.   I suspect CF Administrator is displaying the wrong error message and this is not related to Maximum Pool Size.  That aside is there anyway to increase the POST limit beyond 100 with Standard Edition?  If not, will upgrading our license to Enterprise edition remove this limit?

Trying to wrap my head around this new error I have popping up trying to send an email. This seems to have worked through update 19. I cannot speak for Update 20 because we updated to 20 and then 21 within a few days of each other. I am running the latest approved JVM 11.0.27 from Adobe's site, on Server 2019.  Below is the error I am seeing when I try to send. The page does not end up doing a redirect, but hangs after submit.  Running out of ideas for how to resolve, I have followed another Adobe post but that didn't work either so I reverted back to the old bouncy castle: Solved: CFMAIL Stopped Working After CF2018 Update 14 - Adobe Product Community - 13035484Any suggestions would be welcome, thanks!Jul 10, 2025 12:21:07 PM org.apache.catalina.core.StandardWrapperValve invokeSEVERE: Servlet.service() for servlet [CfmServlet] in context with path [] threw exception [Servlet execution threw an exception] with root causejava.lang.VerifyError: Bad type on operand sta

Hi All,I can't seem to figure this out, so any help would be appreciated.  Might be a bug with CF2021. I got 2 websites with cfapplication name AAA  & BBB  both under same domain, https, using www If I login through one app using SAML (one per app), I loose the sessions in the other app (new cftoken generated), and it doesn't happen everytime but it will happen after a few tests, or the 1st time after being idle for a few minutes......mydomain.com/AAA/saml1/response.cfm.....mydomain.com/BBB/saml2/response.cfm Also, if i'm just playing around and setting a session variable in the same child folders as the saml response, it won't loose the sessions of the other app.  It seems the saml round trip to microsoft azure causes the lost of sessions.  I tried with J2EE sessions on/off Any ideas how to remedy?      

We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes: ColdFusion (2025 release) Update 3 ColdFusion (2023 release) Update 15 ColdFusion (2021 release) Update 21   The updates include a newer version of Tomcat, important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass.    View the security bulletin, APSB25-69, for more information.   Download the updates ColdFusion 2025 updates ColdFusion 2023 updates ColdFusion 2021 updates   What's new in the updates Tomcat upgrade New JVM flag Changes to remote methods OEM upgrades   Others Bug fixes Known issues   Docker and CFFiddle CFFiddle is updated with the changes. Docker images of the update are avaiable on Docker hub and Amazon ECR. Please download and apply t

Hello All, We have a collection of API calls that can successfully be called/run from several windows server instances of CF 2023.  A colleague on intel Mac CF 2018 and one on windows CF 2023 can also successfully call/run any of our API functionality.  On my local development instance of ColdFusion 2023 (ColdFusion 2023 MacBook Pro M2 macOS Sonoma) I consistently get the same error on every API call I try and leverage.Can not resolve PropertyFilter with id 'coldfusion.runtime.Struct'; no FilterProvider configuredI have been unable to make any headway on figuring out why i am the only one getting this error message. I am posting this discussion to hopefully find someone that may have some additional suggestions for me. I can share more examples of some of the code but thought I would start with the error message and the explanation that this is only happening to me as the underlying CF code is working in all other environments. Basic Code Same Error:<cf

Good morning, all. Been getting a flood of error emails generated from production.  Related to Apache POI, but something I have never heard of, before. com/zaxxer/sparsebits/SparseBitSet java.lang.NoClassDefFoundError I looked at the line number indicated in the error message.  Inside of a cfscript tag:...SpreadsheetMergeCells(variables.mySpreadsheet,1,1,1,6);... This is from a Cost Estimate form on our Public site. I've done some digging around, but can't find anything on SparseBitSet.  Or, not much, anyway.  I think I read somewhere that it's not an actual module, so I am guessing there's no package install that can fix this.  Please advise. WolfShade UPDATE:  This isn't affecting only the Cost Estimate form, it appears to also be affecting a Rates Lookup page that uses Excel files to query rates from one port to another.

 Getting the error for all rest services on a subset of our production servers: Cannot resolve PropertyFilter with id 'coldfusion.runtime.Struct'; no FilterProvider configured Appears to be the same error as:Solved: API Error: Can not resolve PropertyFilter with id ... - Adobe Product Community - 14335256 Which is marked Solved but does not seem to be solved.  Ticket that was created related to that post was closed by tech support and not resolved. Wierdly this only occurs on half of the 4 nodes in our cluster.  All servers share same configuration and same code base from shared NAS.  When I hit them directly I can see 2 consistantly return the error:And the other 2 nodes consistantly return expected JSON output. Of course when we hit them load balanced we effectively get random failures depending on what server I am sticky to. I confirmed there are no trailing slashes as called out in the article above: This has persisted thr

My connection to the local SQL Express fails.Connection verification failed for data source: allloginsjava.sql.SQLException: [Macromedia][SQLServer JDBC Driver]Kerberos Authentication is not supported by this SQLServer. The driver attempted Kerberos authentication because the AuthenticationMethod connect option was "auto" and no username/password was specified. It is registered in SSMS and a system DSN in ODBC Data Source Admin.It should connect using windows autth? Any Help much appreciated. See images.