Questions

First of all, I have no coldfusion experience at all. So when answering or asking for coldfusion specifics, please try to keep your answer/question somewhat lightweight :)I’m trying to setup a minimal cfusion2025 image that runs on openshift. I currently have some issues with the image’s existing cfuser or the pod’s permissions.Dockerfile:FROM adobecoldfusion/coldfusion2025:latestUSER rootCOPY ./sources /appEXPOSE 8080 8500Pod logs:Skipping Configuration and Setting Wizardsed: couldn't open temporary file /opt/coldfusion/cfusion/lib/sedFCBEbg: Permission deniedsed: couldn't open temporary file /opt/coldfusion/cfusion/lib/sedMKjs1Y: Permission deniedUpdating webroot to /appConfiguring virtual directorieschown: changing ownership of '/app': Operation not permitted (os error 1)chown: changing ownership of '/app/index.cfm': Operation not permittedchown: changing ownership of '/app/test': Operation not permittedchown: changing ownership of '/app/test/cfm': Operation not permittedchown: chan

Hello, is the coming up release of ColdFusion 2025 updates will bundle the newer version of log4j 2.25.5? There is currently a vulnerability right now with log4j and solr.war version 2.25.4.Thanks,Thao

Are you ready to join the ColdFusion fellowship at Adobe ColdFusion Summit East 2026?Pack the laptop. Find your conference shoes. The ColdFusion fellowship is gathering again.Adobe ColdFusion Summit East 2026 lands in Reston, Virginia, on October 29th. Just outside Wash DC and on the metro, it is easy to find. There is also an onsite workshop on October 28th. If you work with CF, this is a great chance to step away from your code and see what's next.And yes, there will be humans there. Real ones. Not just AI agents.👉 If Summit East gets you thinking about what your CF app needs next, explore TeraTech’s ColdFusion development services. We help teams turn good ideas into CF apps that are safer, faster, and easier to maintain. Two tracks, two different questsThis year, Summit East splits into two tracks.The Adobe ColdFusion Core track covers the CF work teams do every day. Think performance, security, language updates, and ways to keep old apps healthy.The AI in Web Development track loo

Hi All,After applying ColdFusion 2023 Update 26 (2023,0,26,331018)) to our application, I found that the ReReplace method stops matching when the regex pattern is over 1000 characters. This seems to be the new SafeRegex limit introduced in this patch https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-26.html.This has caused a bug in our application in a ReReplace method, which was using a regex more than 1000 characters long. The simple fix is to use something like Replace() instead. Alternatively, the patch mentions:-Dcoldfusion.saferegex.maxpatternlen, which defaults to 1000.Setting the flag and increasing the limit beyond 1000 also fixes the issue. My questions:Is this silent behaviour intended or is this a bug? It just returns the original string unchanged Why has a limit of 1000 been enforced for regex? Are there wider security repercussions for using longer regex patterns?Thanks 

I recently upgraded from Coldfusion 2021 Update 9 to Update 18. I used the package manager to install the update and now I'm getting the message"The Administrator module is not installed". This wasn't an issue on our test instance, but for whatever reason this happened in our production instance (lucky me). The service seems to be running. I just can't get back to the adminstrator site. I tried running the "install administrator" command on CF_ROOT/bin/cfpm.bat but it gives me the following message: "The package adminstrator is not found in the repository."

I’m curious how others are handling the removal of the old Auto-Lockdown program during or after a migration to a newer version of ColdFusion. My current migration process is roughly:Shut down the CF 2021 Windows service Run the CF 2025 installer and Migration Wizard Run the CF 2021 wsconfig to remove the web server Run the CF 2025 wsconfig to add the web serverThat all works as expected, but when it comes time to remove CF 2021 and the Auto-Lockdown tool, I’m not clear on the best way to handle that. I can uninstall CF 2021 without an issue, but when I go to uninstall the Auto-Lockdown tool it suggests it’s going to revert a bunch of settings in IIS, the current CF install, and it will remove the .cfuser account. My guess is that I need to allow it to do those things and then I’ll have to run the Auto-Lockdown for CF 2025, and unfortunately, reconfigure any permissions that were lost when the .cfuser account was recreated. Any recommendations would be appreciated. Thanks

Server Product    ColdFusion 2021Version    2021,0,23,330486Operating System    Windows Server 2019; IISWe are looking at upgrading from CF 2021 to CF 2023 and one of the first steps O have is to remove the IIS connectors via the wsconfig (ben a while since the last upgrade form CF 2016 o CF 2021, so fuzzy). We have two separate systems, a dev and a production, This is all on dev. but i get the same behavior on both instances. I made sure that Visual C++ Redistributable for Visual Studio was installed (it was, but I updated/repaired just in case). I run wsconfig As Administrator (via Explorer or CMD. I just do not get anything to pull down to remove. These instances have been moved since the CF 2016 > CF2021 upgrade, when we migrated rom Windows 2012 to Windows 2019. I am presuming the issue lies there, but not sure how to go about correcting, and do not want o just take too many guesses as we will have to repeat for production.  

Does anyone know what is the best way to run coldfusion2023/config/cfsetup/cfsetup.sh unattended without being prompted for a password (su <runtime_user>)? If I modify the script and remove “su” it runs fine but not sure about security implications.We are running on Ubuntu 24, with stand alone CF2023 servers. Looking to updated/add datasources programmatically using the gitlab pipeline and cfsetup.sh

Let's say the perfect CF developer job exists. It offers fair pay, flexible hours, and fun work. Let's say that job is snagged by an ideal candidate. All seems alright.Then they see the codebase and lack of improvement roadmap. Their eyes go wide like Gollum's. And poof, they're gone. All the pay in the world won't bring them back.An old CF app tells a story. Tidy folders, useful comments, tests, source control, and clear steps all say, "People care." A jungle of copied code, mystery files, and manual steps says, "Fly, you fools!"👉 Need more CF development help? Explore TeraTech’s ColdFusion development services. We help teams care for old CF apps, clean up messy code, and add skilled CF developers.  Developers are interviewing your appGood developers know old apps come with baggage. No one expects a 15-year-old CF app to look brand new. But they do want to see that your team can make it better.Think about two CF jobs with the same pay.  The first app has source control, a working loc

Hello, automated emails sent by our ColdFusion Application (Sunapsis) are failing to reach our users. Our MS Stack team suggested implementing a service account in order to meet higher authentication requirements. Has someone done this in ColdFusion?Also, is it possible we will need to setup an Azure App for OAuth authentication? If so, what documentation does Adobe have for configuring CF 2023 to use the app, client, secret, etc.?Thank you!

Have you listened to the new episode 142 of CF Alive is out? Charlie Arehart joins me to talk about moving to ColdFusion 2025 (and the sneaky Update 8, aka ColdFusion 2026).Charlie always finds hidden gems in every  release!This time we dug into:1) The new AI, MCP, and RAG stuff everyone's talking about (plus what's easy to miss past the AI headlines).2) Subscription-only licensing now. What that really costs your budget over 5 years vs old model.3) The longest "removed features" list Charlie's ever seen. If one old tag is holding your app together, you'll want to hear this.4) HTTPS on CF Admin is easy to turn on now. What Charlie still finds broken out in the field.5) Under the hood, Java 21 and Tomcat 10.1 landed together.If you're planning an upgrade from CF2018 or CF2021, don't walk into Mordor without a map. This episode is your map!See the full episode + show notes.

I'm curious if anyone testing out cf2025, that uses CKeditor has figured out what to do about the out of date messages that it produces when using ckeditor?   I will probably just convert them all to regular text areas, its just pretty annoying how its not up to date with cf2025.  I'm running a development box using the development version.  

Hello Team,These days I am facing weird issue with bulk emails delievery in my application. For example, if I am sending around 300 emails via cfmail tag, sometimes these all emails will go fine and sometimes some emails will stuck in my undelievered emails folder.I end up sending these emails manually, sometimes it gets really bad when undelievered emails goes upto 2000. Through error logs, I am able to see below error:Nov 17, 2023 07:05:09 AM Error [mailWorker-9] - com.sun.mail.smtp.SMTPSendFailedException: 451 4.7.500 Access denied, please try again later. Which is really weird, because rest all successfully delievered emails are sent via same server/using same credentials. Not sure, why it starts saying "Access denied" all of a sudden.Looking forward to hear some possible solutions from community. Please feel free to comment in case you faced similar issue in your application.Thanks,Dhanshree Joshi

Has anyone else experienced problems implementing CF23 update 24 where it seems to be complaining about the colon in the dbvarname. The procedure name is just PACKAGE.PROCEDURE_NAME I don't see the cause of the problem. Actual error: The value ":v_session_id" contains invalid characters. cfprocparam dbvarname=":v_session_id" value="#functionHere()#" type="IN" cfsqltype="cf_sql_varchar"

Website was working fine with hotfix 22.

<cfxml variable="xmlObject" casesensitive="yes"><gallery><album title="Product Detail"><cfoutput query="rsImageFiles"><img src = " http://www.bloodtest.in/Images/Products/#rsImageFiles.Name#" caption = "Flat View" /></cfoutput></album></gallery></cfxml>creates this xml file:<?xml version="1.0" encoding="UTF-8"?><gallery><album title="Product Detail"><img caption="Flat View" src=" http://www.bloodtest.in/Images/Products/B1004Back.jpg"/><img caption="Flat View" src=" http://www.bloodtest.in/Images/Products/B1004Full.jpg"/><img caption="Flat View" src=" http://www.bloodtest.in/Images/Products/B1004Main.jpg"/><img caption="Flat View" src=" http://www.bloodtest.in/Images/Products/B1004Thumb.jpg"/></album></gallery>The elements 'src' and 'caption' have been rearranged. Any way to avoid this? 

Hi,I recently downloaded and installed the version ColdFusion 2025 trial edition using GUI installer.After the installation,I was able to access the ColdFusion Administrator page successfully.However,I do not see the start/stop option for the ColdFusion Application Service in the windows Services console. So, I am unable to restart the service.Could you please advise how to enable or access the ColdFusion service? Thank you 

Hi Support team, I am working on a project in ColdFusion version 2023. Looking to setup the project in dev environment, but it seems the developer/trial version for 2023 link is not activeon the website url below. Can see only latest version 2025 for download.https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-downloads.htmlPlease share the link to download the developer edition for 2023. Thanks 

I am trying to get the PDF manager to work on coldfusion 2025 (developer addition) running on Ubuntu with Apache web server. I did the full GUI install (ColdFusion_2025_GUI_WWEJ_linux64.bin ) select developer addition, all add ons etc. Did no install the separate addons download. So jetty is instslled under cfusion.After installation I can verify the PDF  Manager ( in my case the install changed the port to 8999). Like some other post I have seen I was seeing the unregistered in the log. Selecting edit and saving without any changes allowed me to verify and provided the reghistered log item:May 2, 2025 07:15:06 AM Information [http-nio-8500-exec-4] - PDFg service manager http://127.0.0.1:8997/PDFgServlet/ unregistered.May 2, 2025 07:15:06 AM Information [http-nio-8500-exec-4] - PDFg service manager http://127.0.0.1:8997/PDFgServlet/ registered.I do have it connected to appache anbd the web root is set so in a file called test.cfm I have:<cfhtmltopdf><h1>Hello World<

Using coldfusion version 2021 on production.The daily scheduler is in running status.Its showing next running time, but last run Column is empty for some schedulers Please advise.

Using coldfusion version 2021 on production.The daily scheduler is in running status.Its showing next running time, but last run Column is empty for some schedulers.No error seen inl og. Please advise.

We have a legacy app that extensively uses CFTABLE and CFCOL. Since these tags were removed from CF2025 I was wondering if it would be possible for Adobe to post the source code for these tags so that we can define them as customtags so that we don’t need to manually re-write every page in this application. It doesn’t seem like it would be that big of a deal for them to do this and it would save us a great deal of time and effort as all we would need to do is change <CFTABLE to <CF_CFTABLE and <CFCOL to <CF_CFCOL [or whatever the customtag is called] instead of changing all of the HTML on every single CFM file.thanks. 

Will need to upgrade Windows server from 2016 to 2019 or 2022. Will Coldfusion 2021 release be compatible with Windows Server 2019 or 2022? thanks

today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion.  I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers.  I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.  However the hash published on that page for the packages repository:  (MD5:651E86B76AF4D405EAB2D177EC82EAE3)“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3)”does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.  Below are the download command, results of my download, the file sizes of downloaded files and the hash results.command prompt visual with som