CVE-2026-48320

CVE-2026-48320 is a reflected XSS in ColdFusion's administrative interface that escaped containment through a scope change. The vulnerability likely existed for years behind a compensating control — network-level restriction to admin-only access — which functioned as a substitute for proper input sanitization rather than a complement to it. This is the same failure mode that has produced multiple ColdFusion admin XSS CVEs over the past decade. The administrative zone was treated as a trust perimeter, not an attack surface, and defensive coding investment followed accordingly. Two aspects demand attention beyond standard XSS response. First, the 'scope:changed' designation signals that either the vulnerable code migrated into the admin zone carrying unsanitized inputs, or the administrative interface expanded its reach to resources it previously couldn't touch — either way, the trust boundary assumption is now invalid. Second, the 'victim must open a malicious file' requirement is atypical for reflected XSS (which normally needs only a crafted URL) and suggests this endpoint processes file-based input, likely parsing or reflecting content from the filesystem. That points to a different sanitization path than standard HTTP parameter handling. For defenders: treat this as a pattern failure, not an isolated incident. The fix will patch this specific endpoint, but the underlying assumption — that admin-zone file processing doesn't need rigorous input validation — will persist unless the remediation triggers an audit of all file-handling paths in the administrative interface. Review ColdFusion's admin-facing endpoints that accept file:// URIs, process uploaded content, or perform server-side file inclusion. That's where the next CVE in this lineage will likely surface. If your deployment relied on network restrictions as the primary defense for the admin interface, treat those restrictions as now compromised and layer application-level input validation behind them.

Reviewed through automated stages and approved by a human before publication.