Skip to main content
ruslanr63825226
Participant
Jan 9, 2026 9:01 PM UTC
Question

Coldfusion 2023 Fileupload-1.5.jar Vulnerability

Tenable Security scan has identified Fileupload-1.5.jar as a high Vulnerability. Is this a false positive ? 

C:\ColdFusion2023\bundles\repo\commons-fileupload-1.5.jar Installed version : 1.5 Fixed version : 1.6 Path : C:\ColdFusion2023\bundles\updateinstallers\hotfix-packages-cf2023-016-330828\repo\commons-fileupload-1.5.jar Installed version : 1.5 Fixed version : 1.6 Path : C:\ColdFusion2023\bundles\updateinstallers\hotfix-packages-cf2023-016-330828\repo\commons-fileupload-1.4.jar Installed version : 1.4 Fixed version : 1.6 Path : C:\ColdFusion2023\cfusion\lib\bundleaxis\commons-fileupload-1.5.jar Installed version : 1.5 Fixed version : 1.6 Path :

    3 replies

    BKBK
    Community Expert
    Community Expert
    Jan 10, 2026 4:30 PM UTC

    Hi @ruslanr63825226 , thanks for sharing that.

     

    It is an important alert. I have therefore created a bug ticket requesting a fix.

    Translate
    ruslanr63825226
    Participant
    Jan 20, 2026 3:43 PM UTC

    Coldfusion 23 hotfix 18 did not resolve the issue. Typically never had to update files within ColdFusion directories in the past unless it was a hotfix provided by Adobe. 

    Translate
    BKBK
    Community Expert
    Community Expert
    Jan 20, 2026 8:27 PM UTC

    I think we should give Adobe some time to work on a fix. 

    Translate